Integrated browser wipes cookies and localStorage when the panel is refreshed...
還沒有人認領這個 Issue。
評估
研究方向
Start at the integrated browser panel's refresh/re-creation entry point and trace how the browser context and storage partition are created. Reproduce the refresh with the listed cookie and localStorage probes, then verify that both persist and GET /api/v1/Auth/me remains successful after the panel is recreated.
由索引模型根據 Issue 內容生成。
描述
Integrated browser wipes cookies and localStorage when the panel is refreshed/re-created
Summary
The Copilot app's integrated browser canvas does not persist web storage across a panel refresh. Cookies (including HttpOnly/Secure) and localStorage for the loaded origin are discarded and a fresh, empty storage partition is created. Any web app that relies on cookies or localStorage for authentication is logged out every time the panel is refreshed. The same app in Edge/Chrome keeps its session across reloads.
Environment
GitHub Copilot app (Windows), version 1.0.87-0
Integrated browser UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0
Page under test: local Vite dev server at http://localhost:5173 (Vue SPA), API proxied through Vite at /api
isSecureContext = true on http://localhost:5173
Steps to reproduce
Open the integrated browser to any site that sets a cookie on login (e.g. a local SPA at http://localhost:5173) and log in.
In the page, plant markers that are independent of the app:
document.cookie = '__probe_plain=1; Path=/; Max-Age=86400; SameSite=Lax';
localStorage.setItem('__probe_ls', String(Date.now()));
Confirm they are present: document.cookie and localStorage.getItem('__probe_ls') both return the values.
Refresh the browser panel using the panel's own refresh/reload control (not an in-page F5).
Evaluate document.cookie and localStorage.getItem('__probe_ls') again.
Expected
Cookies with a future Max-Age/Expires and localStorage values persist across a reload, exactly as in Edge/Chrome. The app stays logged in.
Actual
Both are gone. document.cookie is "" and localStorage.getItem('__probe_ls') is null. The only localStorage keys present are ones the page re-creates on load (Vue DevTools). The app's HttpOnly auth cookies are also gone, so the SPA's session bootstrap (GET /api/v1/Auth/me) returns 401 and the user is sent to the login page.
Evidence (single session, 2026-09-24, America/Vancouver)
Time
Observation
20:47:20
Planted __probe_plain, __probe_secure cookies and __probe_ls localStorage key.
20:49:xx
In-page reload via the page's own location.reload() — all probes survived, auth session intact.
20:52:11
document.cookie = __probe_plain=1; __probe_secure=1; GET /api/v1/Auth/me = 200.
20:53:25
Panel re-created (new navigation, performance.getEntriesByType('navigation')[0].type === 'navigate').
20:53:44
document.cookie = ""; localStorage.getItem('__probe_ls') = null; GET /api/v1/Auth/me = 401; POST /api/v1/Auth/refresh = 400 "Refresh token is required" (no cookie sent).
Ruled out on the server side during the same window:
API process did not restart (same PID, start time 20:44:04).
No POST /Auth/logout (the only endpoint that deletes the cookies) was issued.
Cookie lifetimes were 120 minutes (access) and 30 days (refresh); probe cookie Max-Age was 24 hours.
Nothing in the app touches localStorage keys prefixed __probe.
Impact
Any authenticated web app is unusable for iterative testing in the integrated browser: every panel refresh forces a re-login. Because localStorage is wiped as well, there is no client-side storage mechanism an app can use to work around it.
Suggested fix
Back the integrated browser with a persistent storage partition (or at minimum reuse the same in-memory partition when a panel is refreshed/re-created), so cookies and Web Storage behave the same as in a regular Chromium profile.
| Field | Value |
|---|---|
| App version | 1.1.23 |
| OS | Windows 10.0.26200 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Day 3 (Week 1) |
- 主要語言
- 沒有語言資料
- 星號
- 2.1k
- 分支
- 157
- PR 合併指標
- 30 天內沒有已合併 PR
環境準備
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
github/app 的其他 Issue
-
triage
難度 2/5 1-3 小時 新手友好度 70/100
-
難度 2/5 1-3 小時 新手友好度 65/100
-
難度 2/5 1-3 小時 新手友好度 70/100
-
難度 2/5 1-3 小時 新手友好度 70/100
-
難度 2/5 1-3 小時 新手友好度 70/100
相似的 Issue
-
難度 1/5 1-3 小時 新手友好度 88/100
-
bug
難度 2/5 1-3 小時 新手友好度 75/100
AvaloniaUI/Avalonia#22323 ·
維護者通常 1 天內回覆
-
mapper bug
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
clawsweeper:not-repro-on-main impact:ux-friction issue-rating: 🦪 silver shellfish P2
難度 2/5 1-3 小時 新手友好度 64/100
steipete/CodexBar#4040 · 1 則留言 · 1 個 reaction ·
維護者通常 1 天內回覆
-
Zenmap Crash未關閉Zenmap
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 2 天內回覆