Don't send cookies after they reached their expiry time

[ashrafiucse]

Description

Skip cookies that have reached their expiry time when the HTTP Cookie Manager builds the Cookie header for a request.

HC4CookieHandler#getCookiesForUrl now filters out expired cookies (via cookie.isExpired(...)) in addition to the existing domain/path/secure matching. Session cookies, which have no expiry date, are unaffected.

Motivation and Context

Fixes #6428

Cookies that were valid when they were received kept being sent after their expiry time had passed:

1. Add an HTTP Cookie Manager (with "Clear cookies each iteration?" unchecked)
2. Receive a cookie with an Expires/Max-Age attribute in the past's future (e.g. Set-Cookie: session_id=abc123; Expires=<now + 60s>; Path=/)
3. Wait until the expiry time passes
4. Send another request to the same host → the expired cookie is still sent

Root cause: the expiry date is only checked once, when the Set-Cookie header is parsed (addCookieFromHeader). The send path (getCookiesForUrl) filters cookies with cookieSpec.match(...), which matches on domain/path/secure only and never checks isExpired, so a cookie that was valid at reception time is sent forever.

How Has This Been Tested?

• New regression tests in TestHC4CookieManager:
  • testCookieExpiredAfterReceptionIsNotSent: receives a valid cookie (future expiry), simulates the passing of time by moving the stored cookie's expiry into the past, and asserts getCookieHeaderForURL returns null
  • testSessionCookieWithoutExpiryIsStillSent: guards the session-cookie case (no expiry date → still sent)
• Full :src:protocol:http:test suite passes (854 tests, 0 failures)
• ./gradlew classes style passes
• Verified the original repro end-to-end against a locally built distribution (expired cookie no longer sent)

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• My code follows the code style of this project.
• I have updated the documentation accordingly. (release notes entry added to xdocs/changes.xml)

[milamberspace]

@ashrafiucse Thanks for the fix (or new behavior?). The code change looks correct.

But before merge: this changes affect a long-standing runtime behavior: JMeter has been sending expired cookies for years. Some test plans may rely on that, even without knowing it. This is especially true for long-running endurance
tests that outlive a cookie's expiry. With this PR, when the cookie expires, the auth is finish...

This PR will be release with the next major release of JMeter (i.e. 6.0.0), so please improve the PR with:

• Move or reword the changes.xml entry so it reads as a behaviour change, not just a bug fix, add some word in "Incompatible changes" in changes.xml
• Add a note in the HTTP Cookie Manager manual i.e. component_reference.xml. About that expired cookies are no longer sent, and warn about the impact on long-running tests.

Thanks

[ashrafiucse]

Hi @milamberspace, thanks for the review!

I've addressed both points in 29753f3:

• Moved the changes.xml entry out of Bug fixes into a new Incompatible changes section for 6.0.0, worded as a behavior change with a warning about long-running tests that outlive a cookie's expiry time.
• Added a note to the HTTP Cookie Manager section in component_reference.xml stating that expired cookies are no longer sent and warning about the impact on long-running/endurance tests (authentication or session errors, need for re-authentication or session refresh).