getCookieExpirationNever()

Return this in Session.getCookieExpiration for a long-lasting cookie.

Sometimes you don't want the cookie to go away when the user closes his browser. Setting a fixed time limit is bad if your software allows the user to change the server's time. Neither expires nor Max-Age works for this case. Hence, I'll just return something 20 years from now. I see that Google, PayPal, and MSN are doing something similar. If the user sets his time wrong by more than 20 years, he'll have to change his browser's time too.