From 59aab2406e60b390248a72fe94ebaf32eb270996 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 11 Oct 2026 18:42:18 +0000
Subject: [PATCH] Terminal session: a cookie the system deletes is no longer
 sent

A Set-Cookie with Max-Age=0 or an Expires in the past - how a system ends
a session or drops a logon ticket - was stored in the jar like any other
cookie, so the ended session (or the old ticket) went out again on every
later request. It is dropped now, as a browser drops it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
---
 CHANGELOG.md                   |  3 +++
 renderers/terminal/session.mjs | 23 ++++++++++++++++++++---
 test/terminal.test.mjs         | 24 ++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41e2fd0..8dc2d5d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,9 @@
   end of the text (and the `<script>` pattern lazily to every later
   closing tag): 100k characters of `<` in a message box's details held the
   renderer for seconds. A lone `<` is now kept as text.
+- **Terminal session: a cookie the system deletes is dropped.** A
+  `Set-Cookie` with `Max-Age=0` or an `Expires` in the past (an ended
+  session, a logoff) was kept in the jar and sent on every later request.
 - **Terminal renderer** (`renderers/terminal/`, export
   `@abap2ui5/protocol/renderers/terminal`, CLI `abap2ui5-tui <url> [--app
   <CLASS>] [--user u --password p | --cookie c] [--print] [--no-color]`):
diff --git a/renderers/terminal/session.mjs b/renderers/terminal/session.mjs
index 350fa4c..238608d 100644
--- a/renderers/terminal/session.mjs
+++ b/renderers/terminal/session.mjs
@@ -72,10 +72,21 @@ export function parseRoute(h) {
 
 const route = (app, draft) => `app/${app}${draft ? `/${draft}` : ""}`;
 
-/** The cookies of a fetch response: name=value of every Set-Cookie. */
+/** Whether a Set-Cookie deletes its cookie: Max-Age zero or less, or an
+ *  Expires in the past - how a system ends a session or a logon ticket. */
+function expired(c, now = Date.now()) {
+  const maxAge = /;\s*max-age\s*=\s*(-?\d+)/i.exec(c);
+  if (maxAge) return Number(maxAge[1]) <= 0;
+  const expires = /;\s*expires\s*=\s*([^;]+)/i.exec(c);
+  if (!expires) return false;
+  const at = Date.parse(expires[1]);
+  return !Number.isNaN(at) && at <= now;
+}
+
+/** The cookies of a fetch response: [name, value, expired] of every Set-Cookie. */
 function setCookies(headers) {
   const list = typeof headers.getSetCookie === "function" ? headers.getSetCookie() : (headers.get("set-cookie") ? [headers.get("set-cookie")] : []);
-  return list.map((c) => /^\s*([^=;\s]+)=([^;]*)/.exec(c)).filter(Boolean).map((m) => [m[1], m[2]]);
+  return list.map((c) => [/^\s*([^=;\s]+)=([^;]*)/.exec(c), c]).filter(([m]) => m).map(([m, c]) => [m[1], m[2], expired(c)]);
 }
 
 export function createSession({
@@ -146,7 +157,13 @@ export function createSession({
   }
 
   function remember(res) {
-    for (const [k, v] of setCookies(res.headers)) jar.set(k, v);
+    // a cookie the system deletes is dropped, as a browser drops it - kept,
+    // the ended session or the old logon ticket went out again on every
+    // request
+    for (const [k, v, gone] of setCookies(res.headers)) {
+      if (gone) jar.delete(k);
+      else jar.set(k, v);
+    }
   }
 
   async function post(body) {
diff --git a/test/terminal.test.mjs b/test/terminal.test.mjs
index d17eebb..052d917 100644
--- a/test/terminal.test.mjs
+++ b/test/terminal.test.mjs
@@ -270,6 +270,30 @@ test("the session: cookies, basic auth, the CSRF token and the sap-contextid of
   }
 });
 
+test("the session: a cookie the system deletes (Max-Age=0, Expires in the past) is not sent again", async () => {
+  const mock = await startMock();
+  try {
+    const run = mock.run();
+    const [first] = recorded("model.scalar", 0);
+    const [next] = recorded("model.scalar", 1);
+    run.reply({ body: first, headers: { "set-cookie": "SAP_SESSIONID_X=abc; path=/; HttpOnly" } });
+    run.reply({ body: next, headers: { "set-cookie": "SAP_SESSIONID_X=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/" } });
+    run.reply({ body: next, headers: { "set-cookie": "MYSAPSSO2=old; Max-Age=0; path=/" } });
+    run.reply({ body: next });
+    const session = createSession({ url: run.url, cookie: "MYSAPSSO2=t", location: undefined });
+    const app = createTerminalApp({ session });
+    await session.start("Z2UI5_CL_CONF_BIND");
+    while (app.focused().label !== "Check") await app.key("tab");
+    await app.key("enter");
+    await app.key("enter");
+    await app.key("enter");
+    const cookies = run.posts().map((p) => p.headers.cookie);
+    assert.deepEqual(cookies, ["MYSAPSSO2=t", "MYSAPSSO2=t; SAP_SESSIONID_X=abc", "MYSAPSSO2=t", undefined]);
+  } finally {
+    await mock.close();
+  }
+});
+
 // ------------------------------------------------- width, color, text ----
 
 test("width: text wraps, columns shrink with an ellipsis, wide characters take two columns", () => {