[engine.io-client] Node.js: cookies pile up in extraHeaders and are resent on every reconnection

Aperta
  • Qualcosa non va?
#5,592 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

@adityajai119 ci sta già lavorando.

Dal 10/11/2026.

  • #5593 di @adityajai119 — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
20/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
node.js, typescript
Ambito
backend, networking

Direzione di ricerca

Start with packages/engine.io-client/lib/transports/websocket.ts and websocket.node.ts, where the issue traces extraHeaders into the WebSocket options and cookie handling. Reproduce the reconnect sequence from the issue, then inspect the existing tests for Node.js WebSocket cookies. Done means reconnect requests carry only the current session cookie and the user's extraHeaders object remains unchanged; linked PR #5593 is already open.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

In Node.js, with withCredentials: true and the extraHeaders option, the WebSocket transport adds the cookies of the cookie jar to the extraHeaders object passed by the user. The same object is used again when the client reconnects, so the cookies of all previous sessions are sent again:

  • the WebSocket upgrade request of the n-th connection contains the io cookie of every previous session, the oldest first. The cookie package (used by Express) keeps the first value, so the server sees the cookie of the first session;
  • the handshake request of a new connection also sends the stale cookies, since the polling transport sends the extraHeaders too;
  • the user's extraHeaders object gets a cookie array that grows with every connection.

To Reproduce

Socket.IO server version: 4.8.4

Server

import { createServer } from "node:http";
import { Server } from "socket.io";

const httpServer = createServer();
const io = new Server(httpServer, { cookie: true });

httpServer.prependListener("upgrade", (req) => {
  console.log("cookie header of the WebSocket upgrade:", req.headers.cookie);
});

httpServer.listen(3000);

Socket.IO client version: 4.8.4 (with engine.io-client 6.6.8, also reproduced on main)

Client

import { io } from "socket.io-client";

const extraHeaders = { "x-client": "worker" };

const socket = io("http://localhost:3000", {
  withCredentials: true,
  extraHeaders,
  reconnectionDelay: 100,
  reconnectionDelayMax: 100,
});

let upgrades = 0;

socket.io.on("open", () => {
  socket.io.engine.on("upgrade", () => {
    if (++upgrades < 3) {
      // simulate a lost connection
      setTimeout(() => socket.io.engine.close(), 50);
    } else {
      console.log("extraHeaders after 3 connections:", extraHeaders);
      socket.disconnect();
    }
  });
});

Server output:

cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB; io=fESUBNC8aq2u5BTQAAAC

Client output:

extraHeaders after 3 connections: {
  'x-client': 'worker',
  cookie: [
    'io=aUMIMEDX7LYdBrdPAAAA',
    'io=e66IWK-PflQYJs7VAAAB',
    'io=fESUBNC8aq2u5BTQAAAC'
  ]
}

Expected behavior

The extraHeaders object is left untouched, and each request only sends the cookies of the current session:

cookie header of the WebSocket upgrade: io=dggdD1IRbF6NJ1K9AAAA
cookie header of the WebSocket upgrade: io=3yZaeUJ8KeadRiyeAAAB
cookie header of the WebSocket upgrade: io=pEGqOeA_SIilE_A-AAAC

Platform:

  • Device: desktop
  • OS: Windows, Node.js 24.22.1 (the cookie jar is only used in Node.js)

Additional context

doOpen() in packages/engine.io-client/lib/transports/websocket.ts passes this.opts.extraHeaders as opts.headers, and createSocket() in websocket.node.ts then pushes the cookies into opts.headers.cookie. I'm opening a PR with a fix and a test.

AI-assisted: found and reproduced with an AI coding agent; the example above was run locally.

Lingua principale
TypeScript
Stelle
63.2k
Fork
10.2k
Merge medio
6g 4h
PR unite (30g)
6

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di socketio/socket.io

Tutte le issue di socketio/socket.io

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.