Skip to content

fix: reject unsafe-integer maxAge in stringifySetCookie - #288

Closed
ilovesugarr wants to merge 1 commit into
jshttp:masterfrom
ilovesugarr:fix/reject-unsafe-integer-max-age
Closed

fix: reject unsafe-integer maxAge in stringifySetCookie#288
ilovesugarr wants to merge 1 commit into
jshttp:masterfrom
ilovesugarr:fix/reject-unsafe-integer-max-age

Conversation

@ilovesugarr

Copy link
Copy Markdown

Summary

Fix stringifySetCookie emitting invalid Max-Age=1e+21 exponential notation headers for integers >= 1e21.

Motivation

Number.isInteger(1e21) evaluates to true, but converting 1e21 to a string produces "1e+21", violating RFC 6265 §5.2.2 grammar (max-age-value = 1*DIGIT).

Implementation

Use Number.isSafeInteger instead of Number.isInteger in stringifySetCookie.

Testing

Added ["unsafe-integer", 1e21] test case in src/stringify-set-cookie.spec.ts.

@blakeembrey

Copy link
Copy Markdown
Member

Closing in favor of #286

@blakeembrey blakeembrey closed this Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants