[bug] Default MaxAge never applies
betawaffle opened this issue · comments
Describe the bug
Ever since #38, the default MaxAge of 12 hours has not applied, because the check ignores zero.
For us, the current behavior is fine, we actually want session lifetime, but the documentation should be updated, or the default should apply when there is no explicit option given. Perhaps a good idea would be to move the defaulting into parseOptions
instead?
Versions
We found this behavior in v1.6.0, but the bug was introduced in #38.
Steps to Reproduce
Use csrf.Protect
without specifying the MaxAge
option.
Expected behavior
The Max-Age
property on the cookie should be whatever the documentation says the default will be.
Sorry, I meant it was introduced in #39.
We are now. We weren't before, and I have no idea what other people are doing. I suspect, based on what we did, that people who didn't specify it assumed the docs were correct, and that the default of 12 hours was in place.