I'm having expired cookies loaded using PersistCookieJar

[aletorrado]

Hi,

When calling loadForRequest I'm getting cookies that were expired long before even initializing PersistCookieJar with FileStorage.

I was looking into the code and found in PersistCookieJar that the _filter method that seems responsible for filtering expired cookies is only called on _save but not on _load.

Is this an expected behavior? I'm thinking about submitting a PR about this, but wanted to make sure that I was heading to the right direction.

Thanks

[aletorrado]

I found a possible bug in this snippet:

bool _check(String scheme, SerializableCookie cookie) {
  return cookie.cookie.secure && scheme == 'https' || !_isExpired(cookie);
}

It seems like a cookie is checked for expiration only if not secure.

[AlexV525]

Could you provide a reproducible cookie or code snippets so we can statically analyze what's going on?

[aletorrado]

Sure, just run the following snippet:

var tmpDir = await getTemporaryDirectory();
var cookieJar = PersistCookieJar(storage: FileStorage(tmpDir.path));
var cookie = Cookie("demo", "value")..expires = DateTime.now().add(Duration(milliseconds: 500))..secure = true;
var uri = Uri.parse("https://www.google.com/");
await cookieJar.saveFromResponse(uri, [ cookie ]);
sleep(Duration(seconds: 1));
var readCookies = await cookieJar.loadForRequest(uri);

In this code, no cookies should be retrieved, and the readCookies list should be empty. Nevertheless, the cookie is retrieved. I also verified that when not using secure cookies, this bug isn't triggered.

[ReverseScale]

I also encountered this issue. After setting ignoreExpires=false, I found that the cookie does not expire.

[ReverseScale]

It seems like this works.

  bool _check(String scheme, SerializableCookie cookie) {
    // Only send cookie if not expired; Secure cookies require HTTPS
    return !_isExpired(cookie) && (!cookie.cookie.secure || scheme == 'https');
  }