Skip to content

android websocket implementation is incorrect looking app cookies #58358

Description

@dmitryya-tr

Description

cookie lookup for web socket connection(android-kotlin) is ignoring path. if cookie is set on specific path like https://my.domain/my/path function getDefaultOrigin will strip it to ws://my.domain which is incorrect and if set cookie was not sent specifically with path="/" it will mismatch and will potential issues with autorisation and session stickiness

Steps to reproduce

1 set-up backend server which set up cookies without specific path and with path="/". for example "signal-r/hubs/messages"

2 open connection to address observe 2 requests - negotiate - which usually the first one and suppose to pass set-cookies headers. passing cookies with path="/" and without explicit path

3 observe next request with websocket to the exactly same url including "signal-r/hubs/messages" passing only cookies witch match only domain (set cookie with path="/" or received to from domain). expected result path cookies matching full path ws://my.domain/signal-r/hubs/messages

React Native Version

0.87.1

Affected Platforms

Runtime - Android

Output of npx @react-native-community/cli info

info Fetching system and libraries information...
System:
  OS: macOS 26.6.2
  CPU: (12) arm64 Apple M3 Pro
  Memory: 110.34 MB / 36.00 GB
  Shell:
    version: "5.9"
    path: /bin/zsh
Binaries:
  Node:
    version: 22.18.0
    path: /Users/xxx/.nvm/versions/node/v22.18.0/bin/node
  Yarn:
    version: 1.22.22
    path: /opt/homebrew/bin/yarn
  npm:
    version: 10.9.3
    path: /Users/xxx/.nvm/versions/node/v22.18.0/bin/npm
  Watchman:
    version: 2025.07.21.00
    path: /opt/homebrew/bin/watchman
Managers:
  CocoaPods:
    version: 1.16.2
    path: /opt/homebrew/bin/pod
SDKs:
  iOS SDK:
    Platforms:
      - DriverKit 24.5
      - iOS 18.5
      - macOS 15.5
      - tvOS 18.5
      - visionOS 2.5
      - watchOS 11.5
  Android SDK: Not Found
IDEs:
  Android Studio: 2025.1 AI-251.25410.109.2511.13665796
  Xcode:
    version: 16.4/16F6
    path: /usr/bin/xcodebuild
Languages:
  Java:
    version: 17.0.15
    path: /opt/homebrew/opt/openjdk@17/bin/javac
  Ruby:
    version: 2.6.10
    path: /usr/bin/ruby
npmPackages:
  "@react-native-community/cli":
    installed: 15.0.1
    wanted: ~15.0.1
  react:
    installed: 19.1.0
    wanted: 19.1.0
  react-native:
    installed: 0.81.5
    wanted: 0.81.5
  react-native-macos: Not Found
npmGlobalPackages:
  "*react-native*": Not Found
Android:
  hermesEnabled: Not found
  newArchEnabled: Not found
iOS:
  hermesEnabled: Not found
  newArchEnabled: false

Stacktrace or Logs

there is no crash only incorrect behaviour according to rfc6265

MANDATORY Reproducer

https://github.com/dmitryya-tr/react-native-android-websocket-cookies-bug/tree/copilot/create-node-server-react-native-app

Screenshots and Videos

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions