I have an ASP.NET application running on a server in California. The server's current time is:
Bob is connected to my server. Bob is in Texas. His current time is:
My application creates a cookie and set its expiration date.
var name = "MyName";
var value = "MyValue"
var hoursToLive = 24;
var myCookie = new HttpCookie(name )
{
Value = value,
Expires = DateTime.Now.AddHours(hoursToLive)
};
Will the cookie expire in 24 hours, or will it expire in 22 hours due to the time difference between Bob and the server? I know that DateTime.Now uses the server's local time, but I am unclear as to how browsers decide that a cookie is expired (specifically, what time zone is used to determine expiration).
Cookies do include a timezone information with the expires header (mostly GMT), which makes it quite simple for the client to cope with the offset to the server's actual timezone.
Example: expires=Mon,20-Jul-2015 22:00:00 GMT if 2015-07-20 14:00:00 UTC-8 is the server's time. When the client or server decides whether the cookie is expired or not, it will compare it to the associated GMT time.
I dug deeper into the code of System.Web.HttpCookie, and found the relevant code in GetSetCookieHeader():
if (_expirationSet && _expires != DateTime.MinValue) {
s.Append("; expires=");
s.Append(HttpUtility.FormatHttpCookieDateTime(_expires));
}
Where HttpUtility.FormatHttpCookieDateTime() returns a UTC timestamp (with no offset, which doesn't matter because the offset would be zero).
Greenwich Mean Time (GMT) and Coordinated Universal Time (UTC) can, for most purposes, be considered the same. You can read more about this here.