[rifmj]

Three small corrections to the Expires and Max-Age steps of draft-ietf-httpbis-layered-cookies.

1. maxAgeSeen is created inside the loop, so it is false again for every attribute. Max-Age=3600; Expires=<past> is then rejected, and Max-Age=0; Expires=<future> is kept. RFC6265bis: Attributes should specify how missing/invalid values should be handled #2046 says Max-Age and Expires are meant to interact, and all browsers I tried give Max-Age priority (Chromium 156, Firefox 157, WebKit 27.2). The fix moves the variable above the loop.
2. "If attributeValue is failure" tests the wrong variable, so a failed date goes on to the later steps. The fix tests expiryTime.
3. "set expiryTime to the user agent's cookie age limit" assigns a number of days to a time. The fix uses the current time plus the limit, as the comparison just before it does.

There is no change of intent. How a later invalid Expires should behave is a separate question, in #3581.

WPT: cookies/attributes/last-attribute.html in web-platform-tests/wpt#64550 covers item 1.

Drafted with AI help.