Don't send cookies after they reached their expiry time

src/protocol/http/src/main/java/org/apache/jmeter/protocol/http/control/HC4CookieHandler.java

@@ -18,6 +18,7 @@
 package org.apache.jmeter.protocol.http.control;
 
 import java.net.URL;
+import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
@@ -228,7 +229,14 @@ List<org.apache.http.cookie.Cookie> getCookiesForUrl(
         CookieOrigin cookieOrigin = new CookieOrigin(host, port, path, secure);
 
         List<org.apache.http.cookie.Cookie> cookiesValid = new ArrayList<>();
+        // #6428 Cookies must not be sent after they reached their expiry time.
+        // The cookie specs used here do not check the expiry date in match(),
+        // so expired cookies have to be filtered out explicitly.
+        Date now = Date.from(Instant.now());
         for (org.apache.http.cookie.Cookie cookie : cookies) {
+            if (cookie.isExpired(now)) {
+                continue;
+            }
             if (cookieSpec.match(cookie, cookieOrigin)) {
                 cookiesValid.add(cookie);
             }

src/protocol/http/src/test/java/org/apache/jmeter/protocol/http/control/TestHC4CookieManager.java

@@ -259,6 +259,27 @@ public void testOldCookie() throws Exception {
         assertNull(s);
     }
 
+    // Test cookie that was valid when received is not sent anymore
+    // once its expiry time has passed (#6428)
+    @Test
+    public void testCookieExpiredAfterReceptionIsNotSent() throws Exception {
+        URL url = new URL("http://a.b.c/");
+        man.addCookieFromHeader("test=1; expires=Wed, 01-Jan-2099 00:00:00 GMT", url);
+        assertEquals(1, man.getCookieCount());
+        assertEquals("test=1", man.getCookieHeaderForURL(url));
+        // Simulate the passing of time: the cookie is expired by now
+        man.get(0).setExpires(System.currentTimeMillis() / 1000L - 3600L);
+        assertNull(man.getCookieHeaderForURL(url), "expired cookie must not be sent");
+    }
+
+    // Test session cookie (no expiry date) is still sent
+    @Test
+    public void testSessionCookieWithoutExpiryIsStillSent() throws Exception {
+        URL url = new URL("http://a.b.c/");
+        man.addCookieFromHeader("test=1", url);
+        assertEquals("test=1", man.getCookieHeaderForURL(url));
+    }
+
     // Test New cookie is returned
     @Test
     public void testNewCookie() throws Exception {

xdocs/changes.xml

@@ -58,9 +58,20 @@ Summary
 </p>
 <ul>
 <li><a href="#Changes">Changes</a></li>
+<li><a href="#Incompatible changes">Incompatible changes</a></li>
 <li><a href="#Bug fixes">Bug fixes</a></li>
 </ul>
 
+<!-- =================== Incompatible changes =================== -->
+
+<ch_section>Incompatible changes</ch_section>
+<ul>
+  <li><issue>6428</issue>HTTP Cookie Manager no longer sends cookies after they reached their expiry time.
+  Previously, expired cookies kept being sent indefinitely. Long-running tests that outlive a cookie's
+  expiry time may experience authentication or session failures and must handle re-authentication
+  or session refresh.</li>
+</ul>
+
   <ch_section>Changes</ch_section>
   <h3>General</h3>
   <ul>

xdocs/usermanual/component_reference.xml

@@ -3847,6 +3847,12 @@ This means that cross-domain cookies are not stored.
 If you have bugged behaviour or want Cross-Domain cookies to be used, define the JMeter property "<code>CookieManager.check.cookies=false</code>".
 </p>
 <p>
+Cookies that reached their expiry time are no longer sent with requests.
+Be aware that long-running tests, such as endurance tests that outlive a cookie's expiry time,
+will no longer send the cookie once it has expired. This can lead to authentication or session
+errors, so such test plans must handle re-authentication or session refresh.
+</p>
+<p>
 Received Cookies can be stored as JMeter thread variables.
 To save cookies as variables, define the property "<code>CookieManager.save.cookies=true</code>".
 Also, cookies names are prefixed with "<code>COOKIE_</code>" before they are stored (this avoids accidental corruption of local variables)