Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Integrated browser wipes cookies and localStorage when the panel is refreshed...

Ouverte
  • Quelque chose ne va pas ?
#4,201 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
45/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Domaine
desktop, web-dev

Piste de recherche

Start at the integrated browser panel's refresh/re-creation entry point and trace how the browser context and storage partition are created. Reproduce the refresh with the listed cookie and localStorage probes, then verify that both persist and GET /api/v1/Auth/me remains successful after the panel is recreated.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Integrated browser wipes cookies and localStorage when the panel is refreshed/re-created

Summary

The Copilot app's integrated browser canvas does not persist web storage across a panel refresh. Cookies (including HttpOnly/Secure) and localStorage for the loaded origin are discarded and a fresh, empty storage partition is created. Any web app that relies on cookies or localStorage for authentication is logged out every time the panel is refreshed. The same app in Edge/Chrome keeps its session across reloads.

Environment

GitHub Copilot app (Windows), version 1.0.87-0
Integrated browser UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0
Page under test: local Vite dev server at http://localhost:5173 (Vue SPA), API proxied through Vite at /api
isSecureContext = true on http://localhost:5173

Steps to reproduce

Open the integrated browser to any site that sets a cookie on login (e.g. a local SPA at http://localhost:5173) and log in.
In the page, plant markers that are independent of the app:

document.cookie = '__probe_plain=1; Path=/; Max-Age=86400; SameSite=Lax';
localStorage.setItem('__probe_ls', String(Date.now()));
Confirm they are present: document.cookie and localStorage.getItem('__probe_ls') both return the values.
Refresh the browser panel using the panel's own refresh/reload control (not an in-page F5).
Evaluate document.cookie and localStorage.getItem('__probe_ls') again.

Expected

Cookies with a future Max-Age/Expires and localStorage values persist across a reload, exactly as in Edge/Chrome. The app stays logged in.

Actual

Both are gone. document.cookie is "" and localStorage.getItem('__probe_ls') is null. The only localStorage keys present are ones the page re-creates on load (Vue DevTools). The app's HttpOnly auth cookies are also gone, so the SPA's session bootstrap (GET /api/v1/Auth/me) returns 401 and the user is sent to the login page.

Evidence (single session, 2026-09-24, America/Vancouver)

Time
Observation
20:47:20
Planted __probe_plain, __probe_secure cookies and __probe_ls localStorage key.
20:49:xx
In-page reload via the page's own location.reload() — all probes survived, auth session intact.
20:52:11
document.cookie = __probe_plain=1; __probe_secure=1; GET /api/v1/Auth/me = 200.
20:53:25
Panel re-created (new navigation, performance.getEntriesByType('navigation')[0].type === 'navigate').
20:53:44
document.cookie = ""; localStorage.getItem('__probe_ls') = null; GET /api/v1/Auth/me = 401; POST /api/v1/Auth/refresh = 400 "Refresh token is required" (no cookie sent).

Ruled out on the server side during the same window:
API process did not restart (same PID, start time 20:44:04).
No POST /Auth/logout (the only endpoint that deletes the cookies) was issued.
Cookie lifetimes were 120 minutes (access) and 30 days (refresh); probe cookie Max-Age was 24 hours.
Nothing in the app touches localStorage keys prefixed __probe.

Impact

Any authenticated web app is unusable for iterative testing in the integrated browser: every panel refresh forces a re-login. Because localStorage is wiped as well, there is no client-side storage mechanism an app can use to work around it.

Suggested fix

Back the integrated browser with a persistent storage partition (or at minimum reuse the same in-memory partition when a panel is refreshed/re-created), so cookies and Web Storage behave the same as in a regular Chromium profile.

Field Value
App version 1.1.23
OS Windows 10.0.26200
Theme GitHub
Path /chat
Tenure Day 3 (Week 1)
Langage dominant
Aucune donnée de langage
Étoiles
2.1k
Forks
157
Aucune PR mergée en 30 j

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de github/app

Toutes les issues de github/app

Issues similaires

Plus d'issues Desktop Dev

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.