[PR #5853] fix: auto-store Set-Cookie headers and fix cookie retrieval #5380

New issue

Open

opened 2026-03-17 02:49:52 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:49:52 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5853
Author: @FerreiraAdrien
Created: 2/9/2026
Status: 🔄 Open

Base: main ← Head: fix/auto-set-cookies-from-response-headers

📝 Commits (3)

c3b42cf fix: auto-store Set-Cookie headers and fix cookie retrieval
0c7a0b8 fix: correct cookie domain matching and Set-Cookie header parsing
1177ae8 fix: correct cookie domain matching and Set-Cookie header parsing

📊 Changes

3 files changed (+91 additions, -13 deletions)

View changed files

📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/agent/index.ts (+4 -0)
📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/native/index.ts (+38 -2)
📝 packages/hoppscotch-common/src/services/cookie-jar.service.ts (+49 -11)

📄 Description

Closes #3532

When an API response includes Set-Cookie headers, Hoppscotch does not automatically store those cookies in the cookie jar or send them with subsequent requests. Users have to manually add cookies for each domain, which breaks common authentication flows relying on httpOnly cookies.

What's changed

[x] Added applySetCookieHeaders method to CookieJarService that parses raw Set-Cookie header strings and upserts them into the cookie jar (merging by cookie name per domain)
[x] Hooked into the Agent interceptor response flow to automatically capture Set-Cookie headers and persist them via the new method
[x] Hooked into the Native interceptor response flow with the same auto-capture logic, handling both the structured response.cookies array and the raw header fallback
[x] Fixed getCookiesForURL to return stored Cookie objects directly instead of re-parsing cookieString.value, and fixed the expiry comparison to handle ISO string dates

Notes to reviewers

The Set-Cookie handling follows standard domain/path defaulting (falls back to the request hostname and / when not specified by the server)
Cookie upsert is done by name within a domain — if a response updates an existing cookie, it is replaced rather than duplicated

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5853 **Author:** [@FerreiraAdrien](https://github.com/FerreiraAdrien) **Created:** 2/9/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/auto-set-cookies-from-response-headers` --- ### 📝 Commits (3) - [`c3b42cf`](https://github.com/hoppscotch/hoppscotch/commit/c3b42cfd18219a1486bf1bf57ddd8d131b6093da) fix: auto-store Set-Cookie headers and fix cookie retrieval - [`0c7a0b8`](https://github.com/hoppscotch/hoppscotch/commit/0c7a0b811ff4053e9968f67475a9fd122362ce86) fix: correct cookie domain matching and Set-Cookie header parsing - [`1177ae8`](https://github.com/hoppscotch/hoppscotch/commit/1177ae88dddfa1d78cbf5b4acc84faf831777385) fix: correct cookie domain matching and Set-Cookie header parsing ### 📊 Changes **3 files changed** (+91 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/agent/index.ts` (+4 -0) 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/native/index.ts` (+38 -2) 📝 `packages/hoppscotch-common/src/services/cookie-jar.service.ts` (+49 -11) </details> ### 📄 Description Closes #3532 When an API response includes Set-Cookie headers, Hoppscotch does not automatically store those cookies in the cookie jar or send them with subsequent requests. Users have to manually add cookies for each domain, which breaks common authentication flows relying on httpOnly cookies. ### What's changed [x] Added applySetCookieHeaders method to CookieJarService that parses raw Set-Cookie header strings and upserts them into the cookie jar (merging by cookie name per domain) [x] Hooked into the Agent interceptor response flow to automatically capture Set-Cookie headers and persist them via the new method [x] Hooked into the Native interceptor response flow with the same auto-capture logic, handling both the structured response.cookies array and the raw header fallback [x] Fixed getCookiesForURL to return stored Cookie objects directly instead of re-parsing cookieString.value, and fixed the expiry comparison to handle ISO string dates ### Notes to reviewers - The Set-Cookie handling follows standard domain/path defaulting (falls back to the request hostname and / when not specified by the server) - Cookie upsert is done by name within a domain — if a response updates an existing cookie, it is replaced rather than duplicated --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>