We send out cookies from set_last_access_cookie__ in modules/varnish/templates/analytics.inc.vcl.erb that look something like:
Set-Cookie: WMF-Last-Access=12-Oct-2016;Path=/;HttpOnly;secure;Expires=Sun, 13 Nov 2016 12:00:00 GMT
The Expires attribute of the Set-Cookie header was obsoleted in RFC 2109 (February 1997). That RFC was itself obsoleted by RFC 2965 (October 2000). The header should instead look something like:
Set-Cookie: WMF-Last-Access=12-Oct-2016;Path=/;HttpOnly;secure;Max-Age=2764800
Max-Age=value
OPTIONAL. The value of the Max-Age attribute is delta-seconds, the lifetime of the cookie in seconds, a decimal non-negative integer. To handle cached cookies correctly, a client SHOULD calculate the age of the cookie according to the age calculation rules in the HTTP/1.1 specification [RFC2616]. When the age is greater than delta-seconds seconds, the client SHOULD discard the cookie. A value of zero means the cookie SHOULD be discarded immediately. -- https://tools.ietf.org/html/rfc2965