Accepting login challenge with `remember: true, remember_for: 0` creates cookie with 30-day expiration

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

When accepting a login request and specifying remember: true, remember_for: 0, in 2.3.0 this used to create a session ory_hydra_session_dev cookie with no explicit expiration date.

In 25.4.0 and 26.2.0, this instead produces a cookie that expires in 30 days. This prevents me from being able to refresh my own app's session from the user's Hydra session but only until the user closes their browser and discards their Hydra session cookie.

Reproducing the bug

Set up a sample project with default configuration that accepts a login request using remember: true and remember_for: 0. Observe that the response from /oauth2/auth for the Set-Cookie or ory_hydra_session_dev includes Max-Age=2592000 (30 days).

Relevant log output

Relevant configuration

Version

26.2.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Docker Compose

Additional Context

No response