createCookieSessionStorage session expiration with conflicting maxAge and expires

Short answer

When both maxAge and expires are provided to createCookieSessionStorage, maxAge takes precedence and expires is silently dropped. The resulting Set-Cookie header contains only a Max-Age attribute; no Expires attribute is emitted. There is no combined calculation — one attribute simply overrides the other.

Why this happens

Remix does not serialize cookies itself. createCookieSessionStorage passes your cookie options object through to the cookie npm package's serialize() function. That library's behavior is: if maxAge is present, it writes Max-Age and skips Expires entirely.

This is a deliberate choice, not an accident. RFC 6265 specifies that when a browser receives both Max-Age and Expires, Max-Age wins. Since Max-Age is also immune to client clock skew (a wrong system clock can make an absolute Expires date expire immediately or never), the library emits only the more reliable directive.

What this means for session timeouts

• Only maxAge set: header gets Max-Age=<seconds>. This is the recommended approach for session timeouts.
• Only expires set: header gets Expires=<HTTP-date>. Works, but is vulnerable to client clock skew.
• Both set: only Max-Age is sent. Your expires value has no effect — do not treat it as a fallback.
• Neither set: the cookie becomes a browser-session cookie, deleted when the browser closes.

Note that these options only control the cookie's lifetime in the browser. They do not enforce anything server-side — with cookie-based storage the session data lives in the cookie itself, so cookie expiry is the session expiry. If you later switch to a server-backed session store, you must enforce TTL separately.

Verify it yourself

Set up conflicting values and inspect the actual header:

const sessionStorage = createCookieSessionStorage({
  cookie: {
    name: "__session",
    secrets: ["s3cret"],
    maxAge: 60,
    expires: new Date("2099-01-01"), // will be ignored
  },
});

Commit a session in a loader/action and check the response:

curl -sv http://localhost:3000/your-route 2>&1 | grep -i set-cookie

You should see Max-Age=60 and no Expires attribute, confirming the precedence. You can also confirm the delegation by reading the serialize() source in the cookie package inside your node_modules.

Caveats

• Very old browsers (IE ≤ 9) only understand Expires. If you genuinely must support them, set only expires and omit maxAge.
• If you need an absolute expiration timestamp for logging or debugging, compute it yourself (Date.now() + maxAge * 1000) rather than reading the cookie header.
• This behavior is stable across Remix 1.x/2.x and the underlying cookie package, but if you pin unusual dependency versions, run the curl check above to confirm.