[PR #5821] [MERGED] fix(backend): use duration instead of timestamp for auth cookie maxAge #5367

New issue

Closed

opened 2026-03-17 02:49:20 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:49:20 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5821
Author: @njg7194
Created: 2/1/2026
Status: ✅ Merged
Merged: 2/4/2026
Merged by: @jamesgeorge007

Base: patch ← Head: fix/auth-cookie-maxage

📝 Commits (1)

7a7d594 fix(backend): use duration instead of timestamp for auth cookie maxAge

📊 Changes

1 file changed (+2 additions, -2 deletions)

View changed files

📝 packages/hoppscotch-backend/src/auth/helper.ts (+2 -2)

📄 Description

Summary

This PR fixes a bug where auth cookies were being set with incorrect maxAge values, causing authentication issues particularly on macOS.

Problem

The maxAge option in Express's res.cookie() expects a duration in milliseconds, not an absolute timestamp. The previous code was:

maxAge: Date.now() + accessTokenValidityInMs

This caused cookies to have maxAge values of approximately 55+ years (since Date.now() returns ~1.7 trillion milliseconds), rather than the intended 1 day / 7 days.

Solution

Simply use the duration directly:

maxAge: accessTokenValidityInMs

Why macOS was particularly affected

macOS (Safari/WebKit) has stricter cookie handling compared to Chrome on Windows, which caused the "Session expired. Please log in again" errors to be more prevalent on macOS.

Testing

Verified that cookies now correctly expire after their intended validity periods (1 day for access token, 7 days for refresh token)

Fixes #5818

Summary by cubic

Set auth cookies with correct maxAge durations (in milliseconds) instead of absolute timestamps, so they expire as intended—1 day for the access token and 7 days for the refresh token. This fixes unexpected logout issues, especially in Safari on macOS.

^{Written for commit 7a7d594d54. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5821 **Author:** [@njg7194](https://github.com/njg7194) **Created:** 2/1/2026 **Status:** ✅ Merged **Merged:** 2/4/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `patch` ← **Head:** `fix/auth-cookie-maxage` --- ### 📝 Commits (1) - [`7a7d594`](https://github.com/hoppscotch/hoppscotch/commit/7a7d594d54957545cd77e3a2eef212e6a71238ac) fix(backend): use duration instead of timestamp for auth cookie maxAge ### 📊 Changes **1 file changed** (+2 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-backend/src/auth/helper.ts` (+2 -2) </details> ### 📄 Description ## Summary This PR fixes a bug where auth cookies were being set with incorrect `maxAge` values, causing authentication issues particularly on macOS. ## Problem The `maxAge` option in Express's `res.cookie()` expects a **duration in milliseconds**, not an absolute timestamp. The previous code was: ```typescript maxAge: Date.now() + accessTokenValidityInMs ``` This caused cookies to have `maxAge` values of approximately 55+ years (since `Date.now()` returns ~1.7 trillion milliseconds), rather than the intended 1 day / 7 days. ## Solution Simply use the duration directly: ```typescript maxAge: accessTokenValidityInMs ``` ## Why macOS was particularly affected macOS (Safari/WebKit) has stricter cookie handling compared to Chrome on Windows, which caused the "Session expired. Please log in again" errors to be more prevalent on macOS. ## Testing - Verified that cookies now correctly expire after their intended validity periods (1 day for access token, 7 days for refresh token) Fixes #5818  --- ## Summary by cubic Set auth cookies with correct maxAge durations (in milliseconds) instead of absolute timestamps, so they expire as intended—1 day for the access token and 7 days for the refresh token. This fixes unexpected logout issues, especially in Safari on macOS. <sup>Written for commit 7a7d594d54957545cd77e3a2eef212e6a71238ac. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>