Expires vs max-age, which one takes priority if both are declared in a HTTP response?
See this answer:
Difference between three .htaccess expire rules
If a response includes both an Expires header and a max-age directive, the max-age directive overrides the Expires header, even if the Expires header is more restrictive. This rule allows an origin server to provide, for a given response, a longer expiration time to an HTTP/1.1 (or later) cache than to an HTTP/1.0 cache. This might be useful if certain HTTP/1.0 caches improperly calculate ages or expiration times, perhaps due to desynchronized clocks.
This case is explained in the official RFC on W3C.
The max-age directive takes priority over Expires