[engine.io-client] Node.js: cookies pile up in extraHeaders and are resent on every reconnection

オープン
  • 何か問題がありますか？
#5,592 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

@adityajai119 がすでに取り組んでいます。

2026年11月10日 から。

  • #5593 @adityajai119 による — オープン

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
20/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
node.js, typescript
領域
backend, networking

調査の方向性

Start with packages/engine.io-client/lib/transports/websocket.ts and websocket.node.ts, where the issue traces extraHeaders into the WebSocket options and cookie handling. Reproduce the reconnect sequence from the issue, then inspect the existing tests for Node.js WebSocket cookies. Done means reconnect requests carry only the current session cookie and the user's extraHeaders object remains unchanged; linked PR #5593 is already open.

索引モデルが issue の本文から書いたものです。

説明

Describe the bug

In Node.js, with withCredentials: true and the extraHeaders option, the WebSocket transport adds the cookies of the cookie jar to the extraHeaders object passed by the user. The same object is used again when the client reconnects, so the cookies of all previous sessions are sent again:

  • the WebSocket upgrade request of the n-th connection contains the io cookie of every previous session, the oldest first. The cookie package (used by Express) keeps the first value, so the server sees the cookie of the first session;
  • the handshake request of a new connection also sends the stale cookies, since the polling transport sends the extraHeaders too;
  • the user's extraHeaders object gets a cookie array that grows with every connection.

To Reproduce

Socket.IO server version: 4.8.4

Server

import { createServer } from "node:http";
import { Server } from "socket.io";

const httpServer = createServer();
const io = new Server(httpServer, { cookie: true });

httpServer.prependListener("upgrade", (req) => {
  console.log("cookie header of the WebSocket upgrade:", req.headers.cookie);
});

httpServer.listen(3000);

Socket.IO client version: 4.8.4 (with engine.io-client 6.6.8, also reproduced on main)

Client

import { io } from "socket.io-client";

const extraHeaders = { "x-client": "worker" };

const socket = io("http://localhost:3000", {
  withCredentials: true,
  extraHeaders,
  reconnectionDelay: 100,
  reconnectionDelayMax: 100,
});

let upgrades = 0;

socket.io.on("open", () => {
  socket.io.engine.on("upgrade", () => {
    if (++upgrades < 3) {
      // simulate a lost connection
      setTimeout(() => socket.io.engine.close(), 50);
    } else {
      console.log("extraHeaders after 3 connections:", extraHeaders);
      socket.disconnect();
    }
  });
});

Server output:

cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB; io=fESUBNC8aq2u5BTQAAAC

Client output:

extraHeaders after 3 connections: {
  'x-client': 'worker',
  cookie: [
    'io=aUMIMEDX7LYdBrdPAAAA',
    'io=e66IWK-PflQYJs7VAAAB',
    'io=fESUBNC8aq2u5BTQAAAC'
  ]
}

Expected behavior

The extraHeaders object is left untouched, and each request only sends the cookies of the current session:

cookie header of the WebSocket upgrade: io=dggdD1IRbF6NJ1K9AAAA
cookie header of the WebSocket upgrade: io=3yZaeUJ8KeadRiyeAAAB
cookie header of the WebSocket upgrade: io=pEGqOeA_SIilE_A-AAAC

Platform:

  • Device: desktop
  • OS: Windows, Node.js 24.22.1 (the cookie jar is only used in Node.js)

Additional context

doOpen() in packages/engine.io-client/lib/transports/websocket.ts passes this.opts.extraHeaders as opts.headers, and createSocket() in websocket.node.ts then pushes the cookies into opts.headers.cookie. I'm opening a PR with a fix and a test.

AI-assisted: found and reproduced with an AI coding agent; the example above was run locally.

主要言語
TypeScript
スター
63.2k
フォーク
10.2k
平均マージ
6日 4時間
マージ済み PR（30日）
6

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

socketio/socket.io のほかの issue

socketio/socket.io の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。