[Alex0AI]

Problem

get_expired_cookies() gives Expires priority over Max-Age. RFC 6265 section 4.1.2.2 specifies the reverse: https://www.rfc-editor.org/rfc/rfc6265.html#section-4.1.2.2

A response such as Set-Cookie: cookie2=bar; Max-Age=3600; Expires=Thu, 01-Jan-1970 00:00:00 GMT; Path=/ is accepted by Requests, but HTTPie's extra expiration pass then removes the valid cookie from the persisted session. The next request loses cookie2=bar. Conversely, Max-Age=0 combined with a future Expires does not mark a cookie for removal.

Change

Let the existing valid Max-Age conversion override Expires. Invalid Max-Age values still fall back to Expires. Update the malformed-Expires regression: a valid Max-Age remains authoritative even when the date is malformed.

This is separate from #1914's signed Max-Age parsing; the current digit-only parsing is unchanged.

Verification

• New local-server integration test verifies that the cookie survives session persistence and is sent on the next request.
• Five parameterized cases cover both priority directions, a malformed date, and invalid Max-Age fallbacks.
• Before the fix: 4 failed, 2 passed in the new regressions.
• After the fix: python -m pytest tests/test_sessions.py tests/test_cookie.py -q -o addopts='': 68 passed (existing resource/deprecation warnings).
• python -m flake8 httpie/utils.py tests/test_sessions.py and git diff --check passed.

AI assistance disclosure: OpenAI Codex investigated, implemented, tested, and drafted this PR description.

[OKAN-SOFTWARE]

Could we add a negative Max-Age case here?

RFC 6265 allows negative values such as Max-Age=-1 and treats them as immediately expired. At the moment, _max_age_to_expires() uses max_age.isdigit(), which rejects -1.

For example, when a cookie has Max-Age=-1 alongside a future Expires date, the current implementation leaves the future expiration in place. That means Expires incorrectly wins over Max-Age.

A regression case such as ('Fri, 12 Jun 2020 12:28:55 GMT', '-1', True) with the existing test's now=1000.0 should expose this. We could then handle valid signed integers while continuing to ignore malformed values.