Description
cookie lookup for web socket connection(android-kotlin) is ignoring path. if cookie is set on specific path like https://my.domain/my/path function getDefaultOrigin will strip it to ws://my.domain which is incorrect and if set cookie was not sent specifically with path="/" it will mismatch and will potential issues with autorisation and session stickiness
Steps to reproduce
-
1 set-up backend server which set up cookies without specific path and with path="/". for example "signal-r/hubs/messages"
-
2 open connection to address observe 2 requests - negotiate - which usually the first one and suppose to pass set-cookies headers. passing cookies with path="/" and without explicit path
-
3 observe next request with websocket to the exactly same url including "signal-r/hubs/messages" passing only cookies witch match only domain (set cookie with path="/" or received to from domain). expected result path cookies matching full path ws://my.domain/signal-r/hubs/messages
React Native Version
0.81.5
Affected Platforms
Runtime - Android
Output of npx @react-native-community/cli info
info Fetching system and libraries information...
System:
OS: macOS 26.6.2
CPU: (12) arm64 Apple M3 Pro
Memory: 110.34 MB / 36.00 GB
Shell:
version: "5.9"
path: /bin/zsh
Binaries:
Node:
version: 22.18.0
path: /Users/xxx/.nvm/versions/node/v22.18.0/bin/node
Yarn:
version: 1.22.22
path: /opt/homebrew/bin/yarn
npm:
version: 10.9.3
path: /Users/xxx/.nvm/versions/node/v22.18.0/bin/npm
Watchman:
version: 2025.07.21.00
path: /opt/homebrew/bin/watchman
Managers:
CocoaPods:
version: 1.16.2
path: /opt/homebrew/bin/pod
SDKs:
iOS SDK:
Platforms:
- DriverKit 24.5
- iOS 18.5
- macOS 15.5
- tvOS 18.5
- visionOS 2.5
- watchOS 11.5
Android SDK: Not Found
IDEs:
Android Studio: 2025.1 AI-251.25410.109.2511.13665796
Xcode:
version: 16.4/16F6
path: /usr/bin/xcodebuild
Languages:
Java:
version: 17.0.15
path: /opt/homebrew/opt/openjdk@17/bin/javac
Ruby:
version: 2.6.10
path: /usr/bin/ruby
npmPackages:
"@react-native-community/cli":
installed: 15.0.1
wanted: ~15.0.1
react:
installed: 19.1.0
wanted: 19.1.0
react-native:
installed: 0.81.5
wanted: 0.81.5
react-native-macos: Not Found
npmGlobalPackages:
"*react-native*": Not Found
Android:
hermesEnabled: Not found
newArchEnabled: Not found
iOS:
hermesEnabled: Not found
newArchEnabled: false
Stacktrace or Logs
there is no crash only incorrect behaviour according to https://datatracker.ietf.org/doc/html/rfc6265
MANDATORY Reproducer
https://github.com/dmitryya-tr/react-native-android-websocket-cookies-bug/tree/copilot/create-node-server-react-native-app
Screenshots and Videos
No response
Description
cookie lookup for web socket connection(android-kotlin) is ignoring path. if cookie is set on specific path like https://my.domain/my/path function getDefaultOrigin will strip it to ws://my.domain which is incorrect and if set cookie was not sent specifically with path="/" it will mismatch and will potential issues with autorisation and session stickiness
Steps to reproduce
1 set-up backend server which set up cookies without specific path and with path="/". for example "signal-r/hubs/messages"
2 open connection to address observe 2 requests - negotiate - which usually the first one and suppose to pass set-cookies headers. passing cookies with path="/" and without explicit path
3 observe next request with websocket to the exactly same url including "signal-r/hubs/messages" passing only cookies witch match only domain (set cookie with path="/" or received to from domain). expected result path cookies matching full path ws://my.domain/signal-r/hubs/messages
React Native Version
0.81.5
Affected Platforms
Runtime - Android
Output of
npx @react-native-community/cli infoStacktrace or Logs
MANDATORY Reproducer
https://github.com/dmitryya-tr/react-native-android-websocket-cookies-bug/tree/copilot/create-node-server-react-native-app
Screenshots and Videos
No response