CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
What does the 'Max-Age' cookie attribute specify, and how does it differ from 'Expires'?
- A.Max-Age specifies the number of seconds until the cookie expires (relative to when the cookie is set). Expires specifies an absolute date/time. Max-Age takes precedence when both are present. Max-Age is preferred because it avoids clock synchronization issues - the browser's local clock may differ from the server's, causing Expires to behave unpredictably
- B.Max-Age and Expires are identical; browsers implement them the same way
- C.Expires is relative to the server clock; Max-Age is relative to the user's midnight
- D.Max-Age is for session cookies; Expires is for persistent cookies
Why A is correct
Both Max-Age and Expires create persistent cookies. Max-Age is simpler and more reliable: Max-Age=3600 means the cookie expires 1 hour after the browser sets it, using the client's clock for counting. Expires='Wed, 01 Jan 2025 00:00:00 GMT' is an absolute timestamp that depends on clock synchronization between server and client. RFC 6265 says when both are present, Max-Age takes precedence. Always use Max-Age for new development. Expires is maintained for backward compatibility with IE6-8.
Know someone studying for Web App Fundamentals? Send them this one.