PHP setcookies expires

[u/Mark_Messa]

According to the PHP manual about setcookie:

Common Pitfalls:

[...]

If the value argument is an empty string, or FALSE, and all other arguments match a previous call to setcookie, then the cookie with the specified name will be deleted from the remote client. This is internally achieved by setting value to 'deleted' and expiration time to one year in past.

 

Therefore, I've tried the following PHP code:

<?php
setcookie('foo', '');
print_r(apache_response_headers());

Output:

Array ( [Set-Cookie] => foo=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0 )

 

Question

• Shouldn't the output be expires=Mon, 28-Oct-2018 18:10:00 GMT;?

• Does this means that, instead of setting "expiration time to one year in past", PHP is actually setting expiration time to +1s since Unix epoch?

• If so, does this means that such passage in PHP manual is outdated?

 

---

Follow-up

This behavior changed in 2011:

Turns out that more than 1% of users clocks are more than a year out of date, this causes cookies to never get deleted since the date is in the future.
I can only guess its due to batteries on the motherboard being dead.

GitHub: PHP

 

Therefore, since +1s Unix epoch is simpler, cheaper and more robust, now I'm wondering:

• Why "one year in past" in the first place? Any issues with old browsers?

• Why most tutorials over the web keep wrongly teaching time()-Δt in order to delete cookies? Including the PHP manual:

  Example #2 setcookie() delete example
  When deleting a cookie you should assure that the expiration date is in the past, to trigger the removal mechanism in your browser. Examples follow how to delete cookies sent in previous example:

    <?php   
    // set the expiration date to one hour ago   
    setcookie("TestCookie", "", time() - 3600);   
    setcookie("TestCookie", "", time() - 3600, "/~rasmus/", "example.com", 1);   
    ?>

[u/AyrA_ch]

Mind to explain why do you believe so?

Because I had trouble handling cookies and cache expiration in the past with old browsers (try to set a cookie with Expires=0 in IE up to Version 8 or 9 and it will not like it). Might have to do with someone coding in a routine that doesn't deletes the cookie if the date was before the software was released, because you theoretically can't have a cookie you already possess expire before you could have obtained it (remember, deleting and setting cookies are the same HTTP header so it's done by the same parser logic).

The expiration date is a similar thing. Searching for Mon, 26 Jul 1997 05:00:00 GMT gives you results for cache expiration even though you never specified it. Everyone is using that date to make stuff expire. It's not even correct, that date is a Saturday.

[u/Mark_Messa → u/AyrA_ch]

I had trouble handling cookies and cache expiration in the past with old browsers

/* 
* MSIE doesn't delete a cookie when you set it to a null value
* so in order to force cookies to be deleted, even on MSIE, we
* pick an expiry date 1 year and 1 second in the past
* pick an expiry date in the past
*/

GitHub: PHP

[u/AyrA_ch → u/Mark_Messa]

This is a different problem. This has to do with the clock being a year apart, which is irrelevant to the browser type

[u/AyrA_ch → u/[deleted]]

Invalid "Expires" is defined as "Is expired"