Repository: sanic-org/sanic

Issue:
Hard error on invalid max-age cookie
**Describe the bug**
Currently when setting the `max-age` cookie value, it's possible for a valid value to not be set as expected, as well as an invalid value from raising a hard error. In both cases the values are replaced by a `0` `max-age`.


**Code snippet**
```python
response.cookie["my-cookie"]["max-age"] = 10.0  # max-age is set to 0
response.cookie["my-cookie"]["max-age"] = 10.5  # max-age is set to 0
response.cookie["my-cookie"]["max-age"] = "ten"  # max-age is set to 0
response.cookie["my-cookie"]["max-age"] = "10"  # max-age is set to 10
response.cookie["my-cookie"]["max-age"] = 10  # max-age is set to 10
```

**Expected behavior**
Here's what I think the expected behaviour should be (akin to how the `expires` cookie attribute is handled; raising an error if not a `datetime.datetime`).

```python
response.cookie["my-cookie"]["max-age"] = 10.0  # max-age is set to 10
response.cookie["my-cookie"]["max-age"] = 10.5  # raise ValueError
response.cookie["my-cookie"]["max-age"] = "ten"  # raise ValueError
response.cookie["my-cookie"]["max-age"] = "10"  # max-age is set to 10
response.cookie["my-cookie"]["max-age"] = 10  # max-age is set to 10
```

**Environment (please complete the following information):**
 - OS: macOS
 - Version 19.12.2


**Additional context**
I've created a pull request for this here #1809. Here's the issue relating to the original implementation #1452.

Creating this issue so I can have an issue number for the changelog.




Discussion:
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. If this  is incorrect, please respond with an update. Thank you for your contributions.

@ahopkins Should we close the ticket? looks like https://github.com/huge-success/sanic/pull/1457 was fixed the issue.
Let's investigate. That PR was several years ago. There was a change to cookies not that long ago, maybe it is a regression? Let's confirm this on both sanic server and ASGI. I'm not at the computer now to check if there are tests for this already or not.
Looks like for the server we have the tests, but for ASGI don't have.

Resolving patch:
diff --git a/sanic/cookies.py b/sanic/cookies.py
--- a/sanic/cookies.py
+++ b/sanic/cookies.py
@@ -109,7 +109,7 @@ def __setitem__(self, key, value):
         if value is not False:
             if key.lower() == "max-age":
                 if not str(value).isdigit():
-                    value = DEFAULT_MAX_AGE
+                    raise ValueError("Cookie max-age must be an integer")
             elif key.lower() == "expires":
                 if not isinstance(value, datetime):
                     raise TypeError(


Test patch:
diff --git a/tests/test_cookies.py b/tests/test_cookies.py
--- a/tests/test_cookies.py
+++ b/tests/test_cookies.py
@@ -162,7 +162,7 @@ def handler(request):
     assert response.cookies["test"] == "pass"
 
 
-@pytest.mark.parametrize("max_age", ["0", 30, 30.0, 30.1, "30", "test"])
+@pytest.mark.parametrize("max_age", ["0", 30, "30"])
 def test_cookie_max_age(app, max_age):
     cookies = {"test": "wait"}
 
@@ -204,6 +204,23 @@ def handler(request):
         assert cookie is None
 
 
+@pytest.mark.parametrize("max_age", [30.0, 30.1, "test"])
+def test_cookie_bad_max_age(app, max_age):
+    cookies = {"test": "wait"}
+
+    @app.get("/")
+    def handler(request):
+        response = text("pass")
+        response.cookies["test"] = "pass"
+        response.cookies["test"]["max-age"] = max_age
+        return response
+
+    request, response = app.test_client.get(
+        "/", cookies=cookies, raw_cookies=True
+    )
+    assert response.status == 500
+
+
 @pytest.mark.parametrize(
     "expires", [datetime.utcnow() + timedelta(seconds=60)]
 )