Skip to content

fix: cookie handling not working with Hono framework - #1689

Open
perpil wants to merge 4 commits into
awslabs:mainfrom
perpil:main
Open

fix: cookie handling not working with Hono framework#1689
perpil wants to merge 4 commits into
awslabs:mainfrom
perpil:main

Conversation

@perpil

@perpil perpil commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Issue # (if available)

Resolves #1638

Description of changes

Exempt cookie headers from being stripped, they are ok for server-side runtimes.

Checklist

  • Created unit tests in tests/unit and/or in Rust for my feature if needed
  • Ran make fix to format JS and apply Clippy auto fixes
  • Made sure my code didn't add any additional warnings: make check
  • Added relevant type info in types/ directory
  • Updated documentation if needed (API.md/README.md/Other)

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@perpil perpil changed the title Fix cookie handling not working with Hono framework fix: cookie handling not working with Hono framework Jul 28, 2026
@richarddavison

Copy link
Copy Markdown
Collaborator

@perpil thanks for the PR but this fails WPT tests, can you PTAL?

@perpil

perpil commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

This test is expected to fail now that cookies are enabled:

/home/runner/work/llrt/llrt/bundle/js/tests/wpt/fetch.api.request.test.js
fetch/api/request > should pass request-headers.any.js tests
Error: [Adding invalid request header "Cookie: KO"] assert_equals: expected (object) null but got (string) "KO"

I believe the other failures are also expected, but don't have enough familiarity with the WPT tests to know for sure.

Is the correct fix to add header-setcookie.any.js to this file?

@nabetti1720

Copy link
Copy Markdown
Contributor

Personally, I am reluctant to exclude the entire file containing the tests that are currently failing. That is because there are other tests I want to pass.

It would be great if the test runner could be improved to allow specifying files and test cases for exclusion.

runSuite(import.meta.url, runTestDynamic, [
  ["request-headers.any.js", 'Adding invalid request header "Cookie: KO"'], // Exclude specific test cases.
  ["exclude-all-tests.any.js"], // Exclude all tests contained in that file.
]);

@perpil

perpil commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Ok, that makes sense @nabetti1720 I had the filename wrong and didn't realize how many tests were in there. I'll see what I can do to have it skip certain errors.

Update test harness to allow providing a filename and array of errors to ignore. If the array is provided, only the errors to ignore are allowed, the rest of the tests must pass.
Update fetch.api.request.test.ts to ignore errors related to Cookie headers being allowed on Request objects
@perpil

perpil commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

I've added the ability to skip individual tests in a file based on error string or regex and modified it to skip the 3 errors that are expected. Wpt tests are passing, should be good to review now.

@nabetti1720

Copy link
Copy Markdown
Contributor

@richarddavison The modifications to the harness conflict with my PR, so please prioritize this one. :)

Comment on lines +12 to 20
[
"request-headers.any.js",
[
'[Adding invalid request header "Cookie: KO"] assert_equals: expected (object) null but got (string) "KO"',
'[Adding invalid request header "Cookie2: KO"] assert_equals: expected (object) null but got (string) "KO"',
'[Check that request constructor is filtering headers provided as init parameter] assert_equals: expected (object) null but got (string) "potato"',
],
],
]);

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we do a more controlled way of skipping tests? I wonder if this is an XY problem. Why doesn't WPT allow cookie or cookie2 as request header? Is not none spec compliant?
https://fetch.spec.whatwg.org/#cookie-header
https://fetch.spec.whatwg.org/#set-cookie-header

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As I understand WPT is meant for browser based tests. Cookie headers in the browser aren't allowed on Request objects. Since one of the use cases for Node and llrt is server-side, some of the browser cookie related tests are expected to fail. The WPT tests in node seem to have a similar mechanism in the test harness to allow skipping tests: https://github.com/nodejs/node/blob/main/test/wpt/README.md

There are a couple of ways of solving this including commenting out the tests. Since the tests aren't named, I couldn't find a way of omitting tests by name, but let me know if you see a better way. There are multiple tests cases that emit '[Check that request constructor is filtering headers provided as init parameter] assert_equals: expected (object) null but got (string) "potato"' which is unfortunate because it isn't limited to a single test. I believe the way I've implemented it is the closest to how Node does it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

getCookie in hono not working with latest commits

4 participants