[andrewstellman]

Problem

serializeCookie checks options.maxAge for truthiness, so maxAge: 0 emits no Max-Age attribute and the cookie becomes a session cookie instead of expiring:

response.plainCookie('k', 'v', { maxAge: 0 })
// Set-Cookie: k=...; Path=/; HttpOnly   (expected Max-Age=0)

Fix

Treat 0 as a value; undefined, null and '' behave as before.

One behaviour change to be aware of: an app whose config sets cookie: { maxAge: 0 } currently gets session cookies, and after this gets Max-Age=0 on every cookie that doesn't set its own maxAge.

Testing

• npm run quick:test (661 passed)
• npm run typecheck
• npx eslint and prettier --check on the changed files

Found by Quality Playbook, an AI code-review tool, with Claude; I reviewed the change.

[RomainLanz]

Hey @andrewstellman! 👋🏻

I am not 100% sure to merge this as-is. Doing so will result in a silent breaking change for many people that currently rely on maxAge: 0.

Maybe we could find an alternative syntax that doesn't break and still fix the issue?

[andrewstellman]

Thanks, that’s a fair concern. I didn’t consider that maxAge: 0 is how people get a session cookie when a default maxAge is configured. Since maxAge: -1 already produces an immediately expiring cookie (it’s what clearCookie() uses), there’s no need for new syntax. I can turn this PR into a docs change instead: a comment on CookieOptions.maxAge saying that 0 means a session cookie and that a negative value (or clearCookie()) expires the cookie immediately. Or I can close it if you’d rather leave things as they are. Which do you prefer?

…

On Wed, Oct 14, 2026 at 10:33 AM Romain Lanz ***@***.***> wrote: *RomainLanz* left a comment (adonisjs/http-server#145) <#145 (comment)> Hey @andrewstellman <https://github.com/andrewstellman>! 👋🏻 I am not 100% sure to merge this as-is. Doing so will result in a silent breaking change for many people that currently rely on maxAge: 0. Maybe we could find an alternative syntax that doesn't break and still fix the issue? — Reply to this email directly, view it on GitHub <#145?email_source=notifications&email_token=ABZLBCJP7B5RYNGWVG7SPQT5T6FB5A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJXGA4DAMRRGU2KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-6170802154>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABZLBCNFP3MKTWCSQNKQ3535T6FB5AVCNFSNUABFKJSXA33TNF2G64TZHMYTQNZSGM4TONBTHNEXG43VMU5TKNRVGYZTGNRQGE32C5QC> . You are receiving this because you were mentioned.Message ID: ***@***.***>