Specify the default age value used when Access-Control-Max-Age isn't present

[ehsan]

Chromium uses 5 seconds as a default. I'm modifying Gecko accordingly in https://bugzilla.mozilla.org/show_bug.cgi?id=1607615. There is a WPT test which fails only in Firefox because we currently don't consider a default for when this header is missing.

[annevk]

From what I recall the default was supposed to be 24h, but maybe that's only what Jonas intended to ship in Firefox.

@yutakahirano do you know why Chrome has such a low default?

[yutakahirano]

I don't know. It seems the constant was introduced in the WebKit era (search for "= 5;" in the diff).

https://chromium.googlesource.com/chromium/src/+/ac64933b073b0e2280fb19a4d2f9feb561e3403f%5E%21/#F19

[annevk]

Alright, I guess I'll add 5 to the specification and then if we get complaints about that we can all come together and figure out something better. 😊

[annevk]

Oh wait, the default today is 0, and the imposed limit was supposed to be 24h, I remembered that wrong. Okay, will change the default to 5.

[ehsan]

One question that I have is what to do when the response contains Access-Control-Max-Age: \r\n, should we use the default value in that case as well?

[annevk]

That's not really well defined (see #814). Ideally it's consistent with how we parse delta-seconds elsewhere. If no input results in failure, it should be 5 as well.

[ehsan]

Thanks!

[ehsan]

That's not really well defined (see #814). Ideally it's consistent with how we parse delta-seconds elsewhere. If no input results in failure, it should be 5 as well.

web-platform-tests/wpt#21170 adds a test for this.