Integrated browser wipes cookies and localStorage when the panel is refreshed...
还没有人认领这个 Issue。
评估
调研方向
Start at the integrated browser panel's refresh/re-creation entry point and trace how the browser context and storage partition are created. Reproduce the refresh with the listed cookie and localStorage probes, then verify that both persist and GET /api/v1/Auth/me remains successful after the panel is recreated.
由索引模型根据 Issue 内容生成。
描述
Integrated browser wipes cookies and localStorage when the panel is refreshed/re-created
Summary
The Copilot app's integrated browser canvas does not persist web storage across a panel refresh. Cookies (including HttpOnly/Secure) and localStorage for the loaded origin are discarded and a fresh, empty storage partition is created. Any web app that relies on cookies or localStorage for authentication is logged out every time the panel is refreshed. The same app in Edge/Chrome keeps its session across reloads.
Environment
GitHub Copilot app (Windows), version 1.0.87-0
Integrated browser UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0
Page under test: local Vite dev server at http://localhost:5173 (Vue SPA), API proxied through Vite at /api
isSecureContext = true on http://localhost:5173
Steps to reproduce
Open the integrated browser to any site that sets a cookie on login (e.g. a local SPA at http://localhost:5173) and log in.
In the page, plant markers that are independent of the app:
document.cookie = '__probe_plain=1; Path=/; Max-Age=86400; SameSite=Lax';
localStorage.setItem('__probe_ls', String(Date.now()));
Confirm they are present: document.cookie and localStorage.getItem('__probe_ls') both return the values.
Refresh the browser panel using the panel's own refresh/reload control (not an in-page F5).
Evaluate document.cookie and localStorage.getItem('__probe_ls') again.
Expected
Cookies with a future Max-Age/Expires and localStorage values persist across a reload, exactly as in Edge/Chrome. The app stays logged in.
Actual
Both are gone. document.cookie is "" and localStorage.getItem('__probe_ls') is null. The only localStorage keys present are ones the page re-creates on load (Vue DevTools). The app's HttpOnly auth cookies are also gone, so the SPA's session bootstrap (GET /api/v1/Auth/me) returns 401 and the user is sent to the login page.
Evidence (single session, 2026-09-24, America/Vancouver)
Time
Observation
20:47:20
Planted __probe_plain, __probe_secure cookies and __probe_ls localStorage key.
20:49:xx
In-page reload via the page's own location.reload() — all probes survived, auth session intact.
20:52:11
document.cookie = __probe_plain=1; __probe_secure=1; GET /api/v1/Auth/me = 200.
20:53:25
Panel re-created (new navigation, performance.getEntriesByType('navigation')[0].type === 'navigate').
20:53:44
document.cookie = ""; localStorage.getItem('__probe_ls') = null; GET /api/v1/Auth/me = 401; POST /api/v1/Auth/refresh = 400 "Refresh token is required" (no cookie sent).
Ruled out on the server side during the same window:
API process did not restart (same PID, start time 20:44:04).
No POST /Auth/logout (the only endpoint that deletes the cookies) was issued.
Cookie lifetimes were 120 minutes (access) and 30 days (refresh); probe cookie Max-Age was 24 hours.
Nothing in the app touches localStorage keys prefixed __probe.
Impact
Any authenticated web app is unusable for iterative testing in the integrated browser: every panel refresh forces a re-login. Because localStorage is wiped as well, there is no client-side storage mechanism an app can use to work around it.
Suggested fix
Back the integrated browser with a persistent storage partition (or at minimum reuse the same in-memory partition when a panel is refreshed/re-created), so cookies and Web Storage behave the same as in a regular Chromium profile.
| Field | Value |
|---|---|
| App version | 1.1.23 |
| OS | Windows 10.0.26200 |
| Theme | GitHub |
| Path | /chat |
| Tenure | Day 3 (Week 1) |
- 主要语言
- 没有语言数据
- 星标
- 2.1k
- 派生
- 157
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/app 的其他 Issue
-
triage
难度 2/5 1-3 小时 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 65/100
-
难度 2/5 1-3 小时 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 70/100
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
steipete/CodexBar#4009 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
obsproject/obs-studio#13936 · 2 条评论 ·
维护者通常 1 天内回复
-
type: bug
难度 2/5 1-3 小时 新手友好度 68/100
ActivityWatch/activitywatch#1463 · 1 个 reaction ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 88/100
OpenwaterHealth/openmotion-bloodflow-app#625 ·
维护者通常 1 天内回复