This pull request fixes an edge case in res.cookie() where specifying maxAge: null caused the function to produce incorrect cookie headers or throw an internal error.

Previously, maxAge: null was not normalized and led to unintended conversion to 0, causing an undesired Expires header (Max-Age=0).
This behavior conflicted with Express’s intended semantics, where null should mean “no expiration — session cookie”.

✅ Updated Behavior

When maxAge is explicitly null, it is now normalized to undefined.

The cookie is serialized without Expires or Max-Age fields (consistent with session cookies).

Existing logic for finite and numeric maxAge values remains unchanged.

All test cases, including res.cookie(name, string, options) maxAge should not throw on null, now pass successfully.

⚙️ Implementation Summary

In lib/response.js, the logic under res.cookie() was updated:

if (opts.maxAge === null) {
  opts.maxAge = undefined;
}

This ensures that null values are excluded from expiration logic.

✅ Test Results

All 1,238 tests pass locally:

  1238 passing (11s)
  0 failing

🧩 Motivation

This change improves compatibility with earlier Express 4.x behavior, aligns with the HTTP cookie specification for session cookies, and maintains backward compatibility with existing user code.