[engine.io-client] Node.js: cookies pile up in extraHeaders and are resent on every reconnection

Aberta
  • Algo errado?
#5,592 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 2 dias

@adityajai119 já está trabalhando nisso.

Desde 10/11/2026.

  • #5593 de @adityajai119 — aberto

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
20/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Estagnada
Stack de tecnologia
node.js, typescript
Domínio
backend, networking

Direção de pesquisa

Start with packages/engine.io-client/lib/transports/websocket.ts and websocket.node.ts, where the issue traces extraHeaders into the WebSocket options and cookie handling. Reproduce the reconnect sequence from the issue, then inspect the existing tests for Node.js WebSocket cookies. Done means reconnect requests carry only the current session cookie and the user's extraHeaders object remains unchanged; linked PR #5593 is already open.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Describe the bug

In Node.js, with withCredentials: true and the extraHeaders option, the WebSocket transport adds the cookies of the cookie jar to the extraHeaders object passed by the user. The same object is used again when the client reconnects, so the cookies of all previous sessions are sent again:

  • the WebSocket upgrade request of the n-th connection contains the io cookie of every previous session, the oldest first. The cookie package (used by Express) keeps the first value, so the server sees the cookie of the first session;
  • the handshake request of a new connection also sends the stale cookies, since the polling transport sends the extraHeaders too;
  • the user's extraHeaders object gets a cookie array that grows with every connection.

To Reproduce

Socket.IO server version: 4.8.4

Server

import { createServer } from "node:http";
import { Server } from "socket.io";

const httpServer = createServer();
const io = new Server(httpServer, { cookie: true });

httpServer.prependListener("upgrade", (req) => {
  console.log("cookie header of the WebSocket upgrade:", req.headers.cookie);
});

httpServer.listen(3000);

Socket.IO client version: 4.8.4 (with engine.io-client 6.6.8, also reproduced on main)

Client

import { io } from "socket.io-client";

const extraHeaders = { "x-client": "worker" };

const socket = io("http://localhost:3000", {
  withCredentials: true,
  extraHeaders,
  reconnectionDelay: 100,
  reconnectionDelayMax: 100,
});

let upgrades = 0;

socket.io.on("open", () => {
  socket.io.engine.on("upgrade", () => {
    if (++upgrades < 3) {
      // simulate a lost connection
      setTimeout(() => socket.io.engine.close(), 50);
    } else {
      console.log("extraHeaders after 3 connections:", extraHeaders);
      socket.disconnect();
    }
  });
});

Server output:

cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB
cookie header of the WebSocket upgrade: io=aUMIMEDX7LYdBrdPAAAA; io=e66IWK-PflQYJs7VAAAB; io=fESUBNC8aq2u5BTQAAAC

Client output:

extraHeaders after 3 connections: {
  'x-client': 'worker',
  cookie: [
    'io=aUMIMEDX7LYdBrdPAAAA',
    'io=e66IWK-PflQYJs7VAAAB',
    'io=fESUBNC8aq2u5BTQAAAC'
  ]
}

Expected behavior

The extraHeaders object is left untouched, and each request only sends the cookies of the current session:

cookie header of the WebSocket upgrade: io=dggdD1IRbF6NJ1K9AAAA
cookie header of the WebSocket upgrade: io=3yZaeUJ8KeadRiyeAAAB
cookie header of the WebSocket upgrade: io=pEGqOeA_SIilE_A-AAAC

Platform:

  • Device: desktop
  • OS: Windows, Node.js 24.22.1 (the cookie jar is only used in Node.js)

Additional context

doOpen() in packages/engine.io-client/lib/transports/websocket.ts passes this.opts.extraHeaders as opts.headers, and createSocket() in websocket.node.ts then pushes the cookies into opts.headers.cookie. I'm opening a PR with a fix and a test.

AI-assisted: found and reproduced with an AI coding agent; the example above was run locally.

Linguagem predominante
TypeScript
Estrelas
63.2k
Forks
10.2k
Merge médio
6d 4h
PRs com merge (30d)
6

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de socketio/socket.io

Todas as issues de socketio/socket.io

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.