Cookie maxAge in stacks

[ezra-freedman]

I'm curious why the Remix stacks all set maxAge to 0 (expire immediately) in their calls to createCookieSessionStorage.

In the Indie Stack, the only time the template code sets a cookie, it specifies a value for maxAge, which overrides the initialization's value:

"Set-Cookie": await sessionStorage.commitSession(session, {
  maxAge: remember
    ? 60 * 60 * 24 * 7 // 7 days
    : undefined,
}),

I came across this because I was trying to add other data to the stack's sessionStorage and it wasn't persisting. It turns out that this was because I wasn't specifying a maxAge in my call to commitSession so the default of 0 took precedence.

Are there reasons one would want cookies to expire immediately? And even if there are, should that be the default in the stack?

[kiliman]

I think that's a bug in the template. maxAge config in createCookieSession simply provides the default value when you do commitSession. If it's undefined, the cookie will only persist as long as the browser session, which I think is a reasonable default. You should have to opt-in to setting persistent cookies.

As you've seen, a default of 0 is practically useless and should only be used to expire/delete cookies.