Preserve cookies on redirect about got

[sindresorhus]

I have no idea how this is supposed to work tbh. What does the spec say? What does request do?

[floatdrop]

@sindresorhus needle ignores cookies on redirect by default and request will store them in global cookie jar which is not quite good idea (how can I clear it?).

Most browsers will set cookies on 30x response, some sites are using this for authentication.

I have found only one thing about redirects and cookies in RFC 2109:

4.3.5 Sending Cookies in Unverifiable Transactions

Unverifiable transactions typically
arise when a user agent automatically requests inlined or embedded
entities or when it resolves redirection (3xx) responses from an
origin server.

When it makes an unverifiable transaction, a user agent must enable a
session only if a cookie with a domain attribute D was sent or
received in its origin transaction, such that the host name in the
Request-URI of the unverifiable transaction domain-matches D.

So we should set cookies, if it is safe to set it. This will be not easy feature to implement, I guess.

[floatdrop]

In fact we have two problems:

1. Getting cookies from redirect response
2. Setting new cookies to redirect request

While first is easly solved with new redirect event:

got('cookie.com')
    .on('redirect', function (res) {
        console.log(res.headers);
    });

Second is not quite straightforward. May be in this event we could pass headers as second argument:

got('cookie.com')
    .on('redirect', function (res, next) {
        next.headers.cookie = cookie(res);
    });

In this case we will be able to move stuff about cookies (which I like to avoid) to userland.

@sindresorhus @kevva what do you think?

[posabsolute]

I know this is old, but this still an issue? Can we pass cookies when using promises?

[AlbertoFdzM]

I recently tried this.

I'm using a 3rd party service that uses 302 redirects with "Set-Cookie" headers to establish a session.

To clarify how it works:

• any page redirects with 302 to /login if there is no header Cookie set
• /login page always redirects to origin page with 302 and a Set-Cookie header

got doesn't set cookies received from Set-Cookie header but follows redirects, this causes a redirect loop between origin page and login until maxRedirect is reached.

[toBeOfUse]

For me, cookies are currently preserved across redirects with promises as long as I create an (empty) CookieJar and pass it in the request options