[engine.io-client] Node.js: cookies pile up in extraHeaders and are resent on every reconnection

Ouverte
  • Quelque chose ne va pas ?
#5,592 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 2 jours

@adityajai119 y travaille déjà.

Depuis le 10/11/2026.

  • #5593 par @adityajai119 — ouverte

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
20/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
À l'abandon
Stack technique
node.js, typescript
Domaine
backend, networking

Piste de recherche

Start with packages/engine.io-client/lib/transports/websocket.ts and websocket.node.ts, where the issue traces extraHeaders into the WebSocket options and cookie handling. Reproduce the reconnect sequence from the issue, then inspect the existing tests for Node.js WebSocket cookies. Done means reconnect requests carry only the current session cookie and the user's extraHeaders object remains unchanged; linked PR #5593 is already open.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Describe the bug

In Node.js, with withCredentials: true and the extraHeaders option, the WebSocket transport adds the cookies of the cookie jar to the extraHeaders object passed by the user. The same object is used again when the client reconnects, so the cookies of all previous sessions are sent again:

  • the WebSocket upgrade request of the n-th connection contains the io cookie of every previous session, the oldest first. The cookie package (used by Express) keeps the first value, so the server sees the cookie of the first session;
  • the handshake request of a new connection also sends the stale cookies, since the polling transport sends the extraHeaders too;
  • the user's extraHeaders object gets a cookie array that grows with every connection.

To Reproduce

Socket.IO server version: 4.8.4

Server

import { createServer } from "node:http";
import { Server } from "socket.io";

const httpServer = createServer();
const io = new Server(httpServer, { cookie: true });

httpServer.prependListener("upgrade", (req) => {
  console.log("cookie header of the WebSocket upgrade:", req.headers.cookie);
});

httpServer.listen(3000);

Socket.IO client version: 4.8.4 (with engine.io-client 6.6.8, also reproduced on main)

Client

import { io } from "socket.io-client";

const extraHeaders = { "x-client": "worker" };

const socket = io("http://localhost:3000", {
  withCredentials: true,
  extraHeaders,
  reconnectionDelay: 100,
  reconnectionDelayMax: 100,
});

let upgrades = 0;

socket.io.on("open", () => {
  socket.io.engine.on("upgrade", () => {
    if (++upgrades < 3) {
      // simulate a lost connection
      setTimeout(() => socket.io.engine.close(), 50);
    } else {
      console.log("extraHeaders after 3 connections:", extraHeaders);
      socket.disconnect();
    }
  });
});

Server output:

cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB; io=fESUBNC8aq2u5BTQAAAC

Client output:

extraHeaders after 3 connections: {
  'x-client': 'worker',
  cookie: [
    'io=aUMIMEDX7LYdBrdPAAAA',
    'io=e66IWK-PflQYJs7VAAAB',
    'io=fESUBNC8aq2u5BTQAAAC'
  ]
}

Expected behavior

The extraHeaders object is left untouched, and each request only sends the cookies of the current session:

cookie header of the WebSocket upgrade: io=dggdD1IRbF6NJ1K9AAAA
cookie header of the WebSocket upgrade: io=3yZaeUJ8KeadRiyeAAAB
cookie header of the WebSocket upgrade: io=pEGqOeA_SIilE_A-AAAC

Platform:

  • Device: desktop
  • OS: Windows, Node.js 24.22.1 (the cookie jar is only used in Node.js)

Additional context

doOpen() in packages/engine.io-client/lib/transports/websocket.ts passes this.opts.extraHeaders as opts.headers, and createSocket() in websocket.node.ts then pushes the cookies into opts.headers.cookie. I'm opening a PR with a fix and a test.

AI-assisted: found and reproduced with an AI coding agent; the example above was run locally.

Langage dominant
TypeScript
Étoiles
63.2k
Forks
10.2k
Merge moyen
6 j 4 h
PR mergées (30 j)
6

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de socketio/socket.io

Toutes les issues de socketio/socket.io

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.