[Bug]: Chromium, Firefox - Cookies are not properly set/unset during redirect when network interceptor touches headers

[zuzusik]

Version

1.51.0

Steps to reproduce

1. Clone repo at https://github.com/zuzusik/playwright-route-headers-cookie-issue
2. Follow steps in repo's README.md

Expected behavior

Cookies are properly set/unset. Look at screenshots in repo's README.md.

Actual behavior

Chromium: cookie is not unset

Firefox: cookie is not set

Additional context

No response

Environment

Can reproduce locally on MacOS 15.3.1, as well as in Docker on latest Ubuntu. It seems like the issue is platform independent

Node version is 20.10.0, but I doubt it matters.

[yury-s]

If the user overrides request headers, we currently propagate them as is to the redirected requests (see #28758 and #13106). The documentation mentions that "The headers option applies to both the routed request and any redirects it initiates.". This gives you full control over the headers that are sent along with the redirects. We could special case 'Cookie' header and drop it on redirects, but we don't do this for e.g. authorization header and since you have full control over the headers being sent in this case, you can manually delete 'Cookie'.

[zuzusik]

@yury-s based on your reply, I can assume you might have not gotten to the bottom of the issue.

The problem is that when page.route interceptor is set up and it provides headers in route.continue, even without changing them, i.e. return route.continue({headers: route.request().headers()});, cookie is getting lost in Firefox on redirect and cookie is not getting unset in Chrome on redirect.

I firmly believe there is a bug in page.route with handling cookies and redirects (in fact, I have a repo that reproduces it)

I have added more comments in code below to make it more clear.

Look at these handlers: https://github.com/zuzusik/playwright-route-headers-cookie-issue/blob/main/server.js

const setTestCookie = (res, value, expiryDate) => {
    res.header("Set-Cookie", `test-cookie=${value}; expires=${expiryDate.toUTCString()}; path=/`);
    res.redirect("/");
}

app.get('/set-test-cookie', (req, res) => {
    setTestCookie(res, "test-value", new Date(Date.now() + 60 * 60 * 1000));
});

app.get('/clear-test-cookie', (req, res) => {
    setTestCookie(res, "", new Date(0));
});

Look at these tests: https://github.com/zuzusik/playwright-route-headers-cookie-issue/blob/main/tests/cookie.spec.ts

import { test, expect } from '@playwright/test';

async function setsAndClearsCookie(page) {
  await page.goto('http://localhost:3000/');

  // this hits /set-test-cookie where cookie is set and then redirect happens, this fails in Firefox
  await page.getByRole('link', { name: 'Set cookie' }).click(); 

  await expect(page.getByText('"test-cookie": "test-value"')).toBeVisible();

  // this hits /clear-test-cookie where cookie is set and then redirect happens, this fails in Chromium
  await page.getByRole('link', { name: 'Clear cookie' }).click();

  await expect(page.getByText('"test-cookie": "test-value"')).not.toBeVisible();
}

// This fails unexpectedly in FF and Chrome
test('Sets and clears cookie - with interceptor touching headers', async ({ page }) => {
  await page.route('**', (route) => {
    return route.continue({headers: route.request().headers()});
  });

  await setsAndClearsCookie(page);
});

// This passes
test('Sets and clears cookie - with interceptor not touching headers', async ({ page }) => {
  await page.route('**', (route) => {
    return route.continue();
  });

  await setsAndClearsCookie(page);
});

// This passes
test('Sets and clears cookie - without interceptor', async ({ page }) => {
  await setsAndClearsCookie(page);
});

[zuzusik]

So basically, just to boil it down a bit:

After I do

await page.route('**', (route) => {
  return route.continue({headers: route.request().headers()});
});

The same tests that pass otherwise start failing, as cookies are either not set (Firefox) or not unset (Chromium)

This is not expected, I wouldn't expect above code to change anything in how cookies are propagated, but it does.