From 2a258ebfdb915666e2e0d1df2f1f3b5e681aae97 Mon Sep 17 00:00:00 2001 From: Ashraf Ali Date: Sat, 29 Aug 2026 21:56:53 +0600 Subject: [PATCH 1/2] Don't send cookies after they reached their expiry time The cookie specs used by the HTTP Cookie Manager do not check the expiry date when matching cookies for an URL, so cookies that were valid when they were received kept being sent after they expired. Filter expired cookies in HC4CookieHandler#getCookiesForUrl, so they are not sent anymore. Session cookies, which have no expiry date, are not affected. Closes #6428 --- .../http/control/HC4CookieHandler.java | 8 +++++++ .../http/control/TestHC4CookieManager.java | 21 +++++++++++++++++++ xdocs/changes.xml | 1 + 3 files changed, 30 insertions(+) diff --git a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/HC4CookieHandler.java b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/HC4CookieHandler.java index 990b33ecca0..276d9134a31 100644 --- a/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/HC4CookieHandler.java +++ b/src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/HC4CookieHandler.java @@ -18,6 +18,7 @@ package org.apache.jmeter.protocol.http.control; import java.net.URL; +import java.time.Instant; import java.util.ArrayList; import java.util.Date; import java.util.List; @@ -228,7 +229,14 @@ List getCookiesForUrl( CookieOrigin cookieOrigin = new CookieOrigin(host, port, path, secure); List cookiesValid = new ArrayList<>(); + // #6428 Cookies must not be sent after they reached their expiry time. + // The cookie specs used here do not check the expiry date in match(), + // so expired cookies have to be filtered out explicitly. + Date now = Date.from(Instant.now()); for (org.apache.http.cookie.Cookie cookie : cookies) { + if (cookie.isExpired(now)) { + continue; + } if (cookieSpec.match(cookie, cookieOrigin)) { cookiesValid.add(cookie); } diff --git a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/control/TestHC4CookieManager.java b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/control/TestHC4CookieManager.java index 8b242540a47..14bd09959b2 100644 --- a/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/control/TestHC4CookieManager.java +++ b/src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/control/TestHC4CookieManager.java @@ -259,6 +259,27 @@ public void testOldCookie() throws Exception { assertNull(s); } + // Test cookie that was valid when received is not sent anymore + // once its expiry time has passed (#6428) + @Test + public void testCookieExpiredAfterReceptionIsNotSent() throws Exception { + URL url = new URL("http://a.b.c/"); + man.addCookieFromHeader("test=1; expires=Wed, 01-Jan-2099 00:00:00 GMT", url); + assertEquals(1, man.getCookieCount()); + assertEquals("test=1", man.getCookieHeaderForURL(url)); + // Simulate the passing of time: the cookie is expired by now + man.get(0).setExpires(System.currentTimeMillis() / 1000L - 3600L); + assertNull(man.getCookieHeaderForURL(url), "expired cookie must not be sent"); + } + + // Test session cookie (no expiry date) is still sent + @Test + public void testSessionCookieWithoutExpiryIsStillSent() throws Exception { + URL url = new URL("http://a.b.c/"); + man.addCookieFromHeader("test=1", url); + assertEquals("test=1", man.getCookieHeaderForURL(url)); + } + // Test New cookie is returned @Test public void testNewCookie() throws Exception { diff --git a/xdocs/changes.xml b/xdocs/changes.xml index 13e0d097e6d..35dd6b1cdd1 100644 --- a/xdocs/changes.xml +++ b/xdocs/changes.xml @@ -109,6 +109,7 @@ Summary Bug fixes

General

    +
  • 6428HTTP Cookie Manager kept sending cookies after they reached their expiry time.
  • 66546611Support JDK 25 and above for result collectors with empty file names
  • Trim whitespace when parsing numeric JMeter properties so accidental spaces do not silently change configuration values.
  • 6372Fix KeyManager logging when using CLI mode so keystore passwords are not incorrectly reported as missing. Contributed by Patrick Uiterwijk (patrick at puiterwijk.org)
    • From 29753f3a6a20784e1ba42432acbe69b560d95cc0 Mon Sep 17 00:00:00 2001 From: Ashraf Ali Date: Tue, 1 Sep 2026 11:23:44 +0600 Subject: [PATCH 2/2] Document not sending expired cookies as incompatible change Per review feedback on PR #6756: move the changes.xml entry from Bug fixes to a new Incompatible changes section and document the behavior change in the HTTP Cookie Manager reference, warning about the impact on long-running tests that outlive a cookie's expiry. --- xdocs/changes.xml | 12 +++++++++++- xdocs/usermanual/component_reference.xml | 6 ++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/xdocs/changes.xml b/xdocs/changes.xml index 35dd6b1cdd1..b96031cd69c 100644 --- a/xdocs/changes.xml +++ b/xdocs/changes.xml @@ -58,9 +58,20 @@ Summary

    + + +Incompatible changes +
      +
    • 6428HTTP Cookie Manager no longer sends cookies after they reached their expiry time. + Previously, expired cookies kept being sent indefinitely. Long-running tests that outlive a cookie's + expiry time may experience authentication or session failures and must handle re-authentication + or session refresh.
      • +
    + Changes

    General

      @@ -109,7 +120,6 @@ Summary Bug fixes

      General

        -
      • 6428HTTP Cookie Manager kept sending cookies after they reached their expiry time.
      • 66546611Support JDK 25 and above for result collectors with empty file names
      • Trim whitespace when parsing numeric JMeter properties so accidental spaces do not silently change configuration values.
      • 6372Fix KeyManager logging when using CLI mode so keystore passwords are not incorrectly reported as missing. Contributed by Patrick Uiterwijk (patrick at puiterwijk.org)
        • diff --git a/xdocs/usermanual/component_reference.xml b/xdocs/usermanual/component_reference.xml index 663b24fe6e4..783051d8bb1 100644 --- a/xdocs/usermanual/component_reference.xml +++ b/xdocs/usermanual/component_reference.xml @@ -3847,6 +3847,12 @@ This means that cross-domain cookies are not stored. If you have bugged behaviour or want Cross-Domain cookies to be used, define the JMeter property "CookieManager.check.cookies=false".

        +Cookies that reached their expiry time are no longer sent with requests. +Be aware that long-running tests, such as endurance tests that outlive a cookie's expiry time, +will no longer send the cookie once it has expired. This can lead to authentication or session +errors, so such test plans must handle re-authentication or session refresh. +

        +

        Received Cookies can be stored as JMeter thread variables. To save cookies as variables, define the property "CookieManager.save.cookies=true". Also, cookies names are prefixed with "COOKIE_" before they are stored (this avoids accidental corruption of local variables)