- Claes Jakobsson fixed a problem with cookie expiry dates at exctly the epoch

start second "Thu Jan 1 00:00:00 GMT 1970" as the date parser then returns 0
  which internally then is treated as a session cookie. That particular date
  is now made to get the value of 1.

CHANGES

@@ -6,6 +6,12 @@
 
                                   Changelog
 
+Daniel Stenberg (10 Sep 2009)
+- Claes Jakobsson fixed a problem with cookie expiry dates at exctly the epoch
+  start second "Thu Jan 1 00:00:00 GMT 1970" as the date parser then returns 0
+  which internally then is treated as a session cookie. That particular date
+  is now made to get the value of 1.
+
 Daniel Stenberg (2 Sep 2009)
 - Daniel Johnson found a flaw in the code converting sftp-errors to libcurl
   errors.

RELEASE-NOTES

@@ -27,6 +27,7 @@ This release includes the following bugfixes:
  o ftp NOBODY on re-used connection hang
  o configure uses pkg-config for cross-compiles as well
  o improved NSS detection in configure
+ o cookie expiry date at 1970-jan-1 00:00:00
 
 This release includes the following known bugs:
 
@@ -36,6 +37,7 @@ This release would not have looked like this without help, code, reports and
 advice from friends like these:
 
  Karl Moerder, Kamil Dudka, Krister Johansen, Andre Guibert de Bruet,
- Michal Marek, Eric Wong, Guenter Knauf, Peter Sylvester, Daniel Johnson
+ Michal Marek, Eric Wong, Guenter Knauf, Peter Sylvester, Daniel Johnson,
+ Claes Jakobsson
 
         Thanks! (and sorry if I forgot to mention someone)

lib/cookie.c

@@ -365,6 +365,12 @@ Curl_cookie_add(struct SessionHandle *data,
                get parsed for whatever reason. This will have the effect that
                the cookie won't match. */
             co->expires = curl_getdate(what, &now);
+            
+            /* Session cookies have expires set to 0 so if we get that back
+               from the date parser let's add a second to make it a 
+               non-session cookie */
+            if (co->expires == 0)
+                co->expires = 1;
           }
           else if(!co->name) {
             co->name = strdup(name);

tests/data/Makefile.am

@@ -62,7 +62,7 @@ EXTRA_DIST = test1 test108 test117 test127 test20 test27 test34 test46	   \
  test635 test636 test637 test558 test559 test1086 test1087 test1088        \
  test1089 test1090 test1091 test1092 test1093 test1094 test1095 test1096   \
  test1097 test560 test561 test1098 test1099 test562 test563 test1100       \
- test564 test1101 test1102 test1103
+ test564 test1101 test1102 test1103 test565
 
 filecheck:
 	@mkdir test-place; \

tests/data/test565

@@ -0,0 +1,83 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+HTTP GET
+cookies
+</keywords>
+</info>
+# Server-side
+<reply>
+<data>
+HTTP/1.1 301 Moved
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Location: /want/data/5650002
+Server: test-server/fake
+Set-Cookie: test=true; domain=127.0.0.1; path=/; expires=Thu Jan  1 00:00:00 GMT 1970;
+Set-Cookie: test2=true; domain=127.0.0.1; path=/; expires=Fri Feb 2 11:56:27 GMT 2035;
+Connection: close
+
+This server reply is for testing a set-cookie
+
+</data>
+<data2>
+HTTP/1.1 200 Followed here fine swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 52
+
+If this is received, the location following worked
+
+</data2>
+<datacheck>
+HTTP/1.1 301 Moved
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Location: /want/data/5650002
+Server: test-server/fake
+Set-Cookie: test=true; domain=127.0.0.1; path=/; expires=Thu Jan  1 00:00:00 GMT 1970;
+Set-Cookie: test2=true; domain=127.0.0.1; path=/; expires=Fri Feb 2 11:56:27 GMT 2035;
+Connection: close
+
+HTTP/1.1 200 Followed here fine swsclose
+Date: Thu, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 52
+
+If this is received, the location following worked
+
+</datacheck>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+ <name>
+HTTP cookie expiry date at Jan 1 00:00:00 GMT 1970
+ </name>
+ <command>
+http://%HOSTIP:%HTTPPORT/want/565 -L -x %HOSTIP:%HTTPPORT -c log/cookies.jar
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<strip>
+^User-Agent:.*
+</strip>
+<protocol>
+GET http://%HOSTIP:%HTTPPORT/want/565 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+GET http://%HOSTIP:%HTTPPORT/want/data/5650002 HTTP/1.1
+Host: %HOSTIP:%HTTPPORT
+Accept: */*
+Proxy-Connection: Keep-Alive
+Cookie: test2=true
+
+</protocol>
+</verify>
+</testcase>