{"id":2014,"date":"2010-09-01T22:45:55","date_gmt":"2010-09-01T20:45:55","guid":{"rendered":"http:\/\/daniel.haxx.se\/blog\/?p=2014"},"modified":"2010-09-03T23:15:02","modified_gmt":"2010-09-03T21:15:02","slug":"testing-2-digit-year-numbers-in-cookies","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2010\/09\/01\/testing-2-digit-year-numbers-in-cookies\/","title":{"rendered":"Testing 2-digit year numbers in cookies"},"content":{"rendered":"

In the current work of the IETF http-state working group<\/a>, we’re documenting how cookies work. The question came up how browsers and clients treat years in ‘expires’ strings if the year is only specified with two digits. And more precisely, is 69 in the future or in the past?<\/strong><\/p>\n

I decided to figure that out. I setup a little CGI that can be used to check what your browser thinks:<\/p>\n

http:\/\/daniel.haxx.se\/cookie.cgi<\/a><\/p><\/blockquote>\n

It sends a single cookie header that looks like:<\/p>\n

Set-Cookie: testme=yesyes; expires=Wed Sep\u00c2\u00a0 1 22:01:55 69;<\/p><\/blockquote>\n

The CGI script looks like this:<\/p>\n

\n
print \"Content-Type: text\/plain\\n\";\r\nprint \"Set-Cookie: testme=yesyes; expires=Wed Sep\u00c2\u00a0 1 22:01:55 69;\\n\";\r\nprint \"\\nempty?\\n\";\r\nprint $ENV{'HTTP_COOKIE'};<\/pre>\n<\/blockquote>\n
You see that it prints the Cookie: header, so if you reload that URL you should see “testme=yesyes” being output if the cookie is still there. If the cookie is still there, your browser of choice treats the date above as a date in the future<\/em>.<\/p>\n
So, what browsers think 69 is in the future and what think 69 is in the past? Feel free to try out more browsers and tell me the results, this is the list we have so far:<\/p>\n
Future<\/strong>:<\/p>\n
Firefox v3 and v4 (year 2069)
\ncurl (year 2038)
\nIE 7 (year 2069)
\nOpera (year 2036)
\nKonqueror 4.5
\nAndroid<\/p>\n
Past<\/strong>:<\/p>\n
Chrome (both v4 and v5)
\nGnome Epiphany-Webkit<\/p>\n
Thanks to my friends in #rockbox-community that helped me out!<\/p>\n
(this info was originally posted to the httpstate mailing list<\/a>)<\/p>\n
Beyond just “69”<\/h2>\n
(this section was added after my first post)<\/p>\n
After having done the above basic tests, I proceeded and wrote a slightly more involved test that sets 100 cookies in this format:<\/p>\n
\n
Set-Cookie: test$yy=set; expires=Wed Oct\u00c2\u00a0 1 22:01:55 $yy;<\/pre>\n<\/blockquote>\n
When the user reloads this page, the page prints all “test$yy” cookies that get sent to the server. The results with the various browsers is very interesting. These are the ranges different browsers think are future<\/em>:<\/p>\n