Fix cookies expiring at the Unix epoch

[Str0k]

What do these changes do?

Treat a parsed cookie expiration of 0 as a valid timestamp. The existing truthiness check interprets Thu, 01 Jan 1970 00:00:00 GMT as a parse failure, clears the Expires attribute, and retains the cookie. Checking is not None lets the existing expiration machinery remove it.

Two regression cases cover receiving an already-expired cookie and replacing an existing cookie. A local HTTP test sets a cookie, expires it, then verifies the next request sends only an unaffected control cookie. All three cases fail before the fix.

Are there changes in behavior for the user?

Cookies with Expires exactly at the Unix epoch are removed and are no longer sent in subsequent requests. Invalid dates still follow the existing fallback. This is an expiration correctness fix; no vulnerability severity is claimed.

Is it a substantial burden for the maintainers to support this?

The change is one explicit sentinel check in the existing expiration path, with regression coverage and no new API or dependency.

Related issue number

No existing report for this timestamp-zero case was found in the issue/PR searches. Historical #4066 addressed a different expired-cookie scheduling problem.

Checklist

• I think the code is well written (operator review pending)
• Unit tests for the changes exist
• Documentation reflects the changes (news fragment; no API change)
• If you provide code modification, please add yourself to CONTRIBUTORS.txt
• Add a new news fragment into the CHANGES/ folder

Local validation and limitations

Windows, Python 3.12.10, pure Python aiohttp, base 5da6d53032d59a08faeba2fab96361864c817faa.

Before the fix:

pytest tests/test_cookiejar.py::test_cookie_expires_at_unix_epoch tests/test_client_functional.py::test_cookie_expired_at_epoch_is_not_sent -q --tb=short -o addopts='' -p no:aiohttp
3 failed

After the fix:

pytest tests/test_cookiejar.py tests/test_client_functional.py -k cookie -q --tb=short -o addopts='' -p no:aiohttp
111 passed, 2 skipped, 306 deselected

The skipped tests require POSIX permission bits. Black 26.5.1, isort 9.0.1 and flake8 7.3.0 pass for the three changed Python files. Mypy with --follow-imports=silent passes for those files. Without that flag, mypy reports 16 diagnostics in four other imported modules, including platform-specific Gunicorn/Windows issues; a complete project type-check is not claimed. Cython extensions were not built; this changes CookieJar expiration dispatch, not the HTTP or WebSocket parsers.

Drafted with Codex (GPT-6); human review pending from @Str0k. Kept in draft as required by AGENTS.md.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.03%. Comparing base (5da6d53) to head (c1ce760).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13692   +/-   ##
=======================================
  Coverage   99.03%   99.03%           
=======================================
  Files         135      135           
  Lines       50940    50971   +31     
  Branches     2677     2678    +1     
=======================================
+ Hits        50446    50477   +31     
  Misses        370      370           
  Partials      124      124           

Flag	Coverage Δ
Autobahn	21.94% <9.37%> (-0.01%)	⬇️
CI-GHA	98.92% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.69% <100.00%> (+<0.01%)	⬆️
OS-Windows	97.31% <100.00%> (+<0.01%)	⬆️
OS-macOS	98.18% <100.00%> (+<0.01%)	⬆️
Py-3.10	98.12% <100.00%> (+<0.01%)	⬆️
Py-3.11	98.35% <100.00%> (+<0.01%)	⬆️
Py-3.12	98.44% <100.00%> (+<0.01%)	⬆️
Py-3.13	98.43% <100.00%> (+<0.01%)	⬆️
Py-3.14	98.45% <100.00%> (-0.01%)	⬇️
Py-3.14t	97.83% <100.00%> (+<0.01%)	⬆️
Py-pypy-3.11	97.40% <100.00%> (-0.01%)	⬇️
VM-macos	98.18% <100.00%> (+<0.01%)	⬆️
VM-ubuntu	98.69% <100.00%> (+<0.01%)	⬆️
VM-windows	97.31% <100.00%> (+<0.01%)	⬆️
cython-coverage	83.21% <95.65%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 97 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing Str0k:fix/cookie-expiration-at-epoch (c1ce760) with master (5da6d53)}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩