Description

parseSetCookie assigns an Invalid Date to the parsed cookie's expires when the Set-Cookie Expires attribute fails to parse, instead of ignoring the attribute.

getSetCookies(new Headers({ 'set-cookie': 'id=a3fWa; Expires=not-a-date' }))
// [{ name: 'id', value: 'a3fWa', expires: Invalid Date }]
// should be: [{ name: 'id', value: 'a3fWa' }]

RFC 6265bis section 5.4.1 step 2 says that if the attribute-value fails to parse as a cookie date, the user agent must ignore the cookie-av. The code comment at that spot already states this, but the assignment ran unconditionally, leaking an Invalid Date into the returned object.

Fix

Only set expires when the parsed date is valid.

     // 2. If the attribute-value failed to parse as a cookie date, ignore
     //    the cookie-av.
-
-    cookieAttributeList.expires = expiryTime
+    if (!Number.isNaN(expiryTime.getTime())) {
+      cookieAttributeList.expires = expiryTime
+    }

Valid Expires values are unchanged.

Test

Added a case to test/cookie/cookies.js for an unparseable Expires. It fails before the change (expires: Invalid Date present) and passes after (attribute omitted). Full cookie suite stays green.