[engine.io-client] Node.js: cookies pile up in extraHeaders and are resent on every reconnection

Offen
  • Stimmt etwas nicht?
#5,592 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 2 Tagen

@adityajai119 arbeitet bereits daran.

Seit 10.11.2026.

  • #5593 von @adityajai119 — offen

Bewertung

Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Anfängerfreundlichkeit
20/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Veraltet
Tech-Stack
node.js, typescript
Bereich
backend, networking

Rechercherichtung

Start with packages/engine.io-client/lib/transports/websocket.ts and websocket.node.ts, where the issue traces extraHeaders into the WebSocket options and cookie handling. Reproduce the reconnect sequence from the issue, then inspect the existing tests for Node.js WebSocket cookies. Done means reconnect requests carry only the current session cookie and the user's extraHeaders object remains unchanged; linked PR #5593 is already open.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Describe the bug

In Node.js, with withCredentials: true and the extraHeaders option, the WebSocket transport adds the cookies of the cookie jar to the extraHeaders object passed by the user. The same object is used again when the client reconnects, so the cookies of all previous sessions are sent again:

  • the WebSocket upgrade request of the n-th connection contains the io cookie of every previous session, the oldest first. The cookie package (used by Express) keeps the first value, so the server sees the cookie of the first session;
  • the handshake request of a new connection also sends the stale cookies, since the polling transport sends the extraHeaders too;
  • the user's extraHeaders object gets a cookie array that grows with every connection.

To Reproduce

Socket.IO server version: 4.8.4

Server

import { createServer } from "node:http";
import { Server } from "socket.io";

const httpServer = createServer();
const io = new Server(httpServer, { cookie: true });

httpServer.prependListener("upgrade", (req) => {
  console.log("cookie header of the WebSocket upgrade:", req.headers.cookie);
});

httpServer.listen(3000);

Socket.IO client version: 4.8.4 (with engine.io-client 6.6.8, also reproduced on main)

Client

import { io } from "socket.io-client";

const extraHeaders = { "x-client": "worker" };

const socket = io("http://localhost:3000", {
  withCredentials: true,
  extraHeaders,
  reconnectionDelay: 100,
  reconnectionDelayMax: 100,
});

let upgrades = 0;

socket.io.on("open", () => {
  socket.io.engine.on("upgrade", () => {
    if (++upgrades < 3) {
      // simulate a lost connection
      setTimeout(() => socket.io.engine.close(), 50);
    } else {
      console.log("extraHeaders after 3 connections:", extraHeaders);
      socket.disconnect();
    }
  });
});

Server output:

cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB; io=fESUBNC8aq2u5BTQAAAC

Client output:

extraHeaders after 3 connections: {
  'x-client': 'worker',
  cookie: [
    'io=aUMIMEDX7LYdBrdPAAAA',
    'io=e66IWK-PflQYJs7VAAAB',
    'io=fESUBNC8aq2u5BTQAAAC'
  ]
}

Expected behavior

The extraHeaders object is left untouched, and each request only sends the cookies of the current session:

cookie header of the WebSocket upgrade: io=dggdD1IRbF6NJ1K9AAAA
cookie header of the WebSocket upgrade: io=3yZaeUJ8KeadRiyeAAAB
cookie header of the WebSocket upgrade: io=pEGqOeA_SIilE_A-AAAC

Platform:

  • Device: desktop
  • OS: Windows, Node.js 24.22.1 (the cookie jar is only used in Node.js)

Additional context

doOpen() in packages/engine.io-client/lib/transports/websocket.ts passes this.opts.extraHeaders as opts.headers, and createSocket() in websocket.node.ts then pushes the cookies into opts.headers.cookie. I'm opening a PR with a fix and a test.

AI-assisted: found and reproduced with an AI coding agent; the example above was run locally.

Vorherrschende Sprache
TypeScript
Sterne
63.2k
Forks
10.2k
Ø Merge
6 T. 4 Std.
Gemergte PRs (30 T.)
6

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus socketio/socket.io

Alle Issues in socketio/socket.io

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.