fix: return non-secure cookies with HTTPS URLs #5507
Conversation
Cookies have a "Secure" attribute which tells the browsers that a given cookie should only be sent via HTTPS. In it's absense "Secure" is falsy and these cookies should be sent with both HTTP and HTTPS requests. Playwright now returns only the "Non-Secure" cookies for HTTP URLs, and both "Secure" and "Non-Secure" cookies for HTTPS URLs. Fixes #5504
|
I didn't end up changing the API docs for this fix; under
And that seems appropriate still. I thought about adding another sentence there, along the lines of...
But that seems like part of "only cookies that affect those URLs". Let me know what you think! |
Some tests in //tests/browsercontext-cookies.spec.ts used a mix of Array.sort and str.localeCompare. This comes from a suggestion from @mxschmitt. See #5507
|
Oh darn, that last commit should have read |
Cookies have a "Secure" attribute which tells the browsers that a given cookie should only be sent via HTTPS. In it's absense "Secure" is falsy and these cookies should be sent with both HTTP and HTTPS requests. Playwright now returns only the "Non-Secure" cookies for HTTP URLs, and both "Secure" and "Non-Secure" cookies for HTTPS URLs.
Fixes #5504