Skip to content

Throw "invalid cookie domain" as its definition implies#1955

Merged
whimboo merged 2 commits intow3c:masterfrom
yezhizhen:update-cookie
Apr 1, 2026
Merged

Throw "invalid cookie domain" as its definition implies#1955
whimboo merged 2 commits intow3c:masterfrom
yezhizhen:update-cookie

Conversation

@yezhizhen
Copy link
Copy Markdown
Member

@yezhizhen yezhizhen commented Mar 26, 2026

See servo/servo#43690 (comment)

The definition of InvalidCookieDomain is: An illegal attempt was made to set a cookie under a different domain than the current page.

But somehow, the spec asks to throw "invalid argument" error for this case.
However, all browsers indeed throw "invalid cookie domain" for this case.

Following test aligns with current spec, yet fails for all browsers.

def test_add_cookie_with_domain_not_matching_current_domain(session, url):
    session.url = url("/common/blank.html")

    new_cookie = {
        "name": "hello",
        "value": "world",
        "domain": "example.com",
        "path": "/",
        "httpOnly": False,
        "secure": False
    }

    response = add_cookie(session, new_cookie)
    assert_error(response, "invalid argument")

This change is Reviewable


Preview | Diff

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
@yezhizhen
Copy link
Copy Markdown
Member Author

cc @whimboo @xiaochengh

@yezhizhen yezhizhen changed the title Throw "invalid cookie domain" as its name suggests Throw "invalid cookie domain" as its definition implies Mar 26, 2026
github-merge-queue bot pushed a commit to servo/servo that referenced this pull request Mar 26, 2026
Improve the error reporting for [cookie
addition](https://w3c.github.io/webdriver/#add-cookie).
Most notably, when
- expiry time exceeds maximum safe integer
- cookie domain is not equal to session's current browsing context's
active document's domain

There is a bug with spec:
#43690 (comment).
We fix spec in w3c/webdriver#1955 and
make sure Servo behaves consistently with other browsers.

Testing: Added one test for invalid expiry time. New passing with
existing.

---------

Signed-off-by: Euclid Ye <yezhizhenjiakang@gmail.com>
@whimboo
Copy link
Copy Markdown
Contributor

whimboo commented Mar 26, 2026

This makes sense. Thanks for discovering that discrepancy. The referenced tests can be found here but I have to add that we only test unsupported schemes for invalid cookie domain. We should indeed at least one more test with a valid domain. @yezhizhen mind adding one respectively? Thanks!

@yezhizhen
Copy link
Copy Markdown
Member Author

Adding one more in web-platform-tests/wpt#58801

Comment thread index.html Outdated
Comment on lines 7606 to 7618
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you mind to move this second block up before the invalid cookie domain one so that we have the type checks for the cookie data together? In the moment the browsing context check separates them.

This will also fix the issue that we should fail with invalid argument when the cookie domain is invalid. We should only see invalid cookie domain if the type check for cookie domain succeeded but the actual domain is incorrect.

This is what browsers actually should do these days as well and we actually miss all those invalid test cases for this command. :/ But to add those is not a blocker for this PR to get merged.

Signed-off-by: Euclid Ye <euclid.ye@huawei.com>
@yezhizhen yezhizhen requested a review from whimboo April 1, 2026 03:57
Copy link
Copy Markdown
Contributor

@whimboo whimboo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@w3cbot
Copy link
Copy Markdown

w3cbot commented Apr 1, 2026

whimboo marked as non substantive for IPR from ash-nazg.

@whimboo
Copy link
Copy Markdown
Contributor

whimboo commented Apr 1, 2026

@yezhizhen given that you contributed a lot already please try to join the W3C group if possible so that the IP check wouldn't cause us trouble.

@whimboo whimboo merged commit 370aeff into w3c:master Apr 1, 2026
2 checks passed
github-actions bot added a commit that referenced this pull request Apr 1, 2026
SHA: 370aeff
Reason: push, by whimboo

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
github-actions bot added a commit to soloinovator/webdriver that referenced this pull request Apr 1, 2026
SHA: 370aeff
Reason: push, by pull[bot]

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
github-actions bot added a commit to xjc90s/webdriver that referenced this pull request Apr 1, 2026
SHA: 370aeff
Reason: push, by pull[bot]

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@yezhizhen yezhizhen deleted the update-cookie branch April 9, 2026 14:59
@yezhizhen
Copy link
Copy Markdown
Member Author

@yezhizhen given that you contributed a lot already please try to join the W3C group if possible so that the IP check wouldn't cause us trouble.

I just joined!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants