fix: preserve explicit Cookie headers in extension requests

pkg/download/engine/fetch_integration_test.go

@@ -105,6 +105,95 @@ func TestXMLHttpRequestUsesFetch(t *testing.T) {
 	}
 }
 
+func TestExtensionRequestsSendExplicitCookie(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		_, _ = w.Write([]byte(request.Header.Get("Cookie")))
+	}))
+	t.Cleanup(server.Close)
+
+	type requestTest struct {
+		name   string
+		script string
+	}
+	tests := []requestTest{
+		{"fetch record", `const response = await fetch(url, {headers: {Cookie: cookie}}); return response.text();`},
+		{"fetch Headers", `const response = await fetch(url, {headers: new Headers({cookie})}); return response.text();`},
+		{"fetch pairs", `const response = await fetch(url, {headers: [["cOoKiE", cookie]]}); return response.text();`},
+		{"fetch Request clone", `const request = new Request(url, {headers: {Cookie: cookie}}); const response = await fetch(request.clone()); return response.text();`},
+		{"fetch Request set", `const request = new Request(url); request.headers.set("Cookie", cookie); const response = await fetch(request); return response.text();`},
+		{"fetch Request append", `const request = new Request(url); request.headers.append("Cookie", cookie); const response = await fetch(request); return response.text();`},
+		{"fetch no-cors mutations", `const request = new Request(url, {mode: "no-cors"}); request.headers.set("Cookie", "removed=1"); request.headers.delete("COOKIE"); if (request.headers.has("cookie")) throw new Error("Cookie was not deleted"); request.headers.append("Cookie", cookie); const response = await fetch(request.clone()); return response.text();`},
+	}
+	for _, mode := range []string{"cors", "same-origin", "no-cors"} {
+		for _, credentials := range []string{"omit", "same-origin", "include"} {
+			tests = append(tests, requestTest{
+				name:   "fetch " + mode + " " + credentials,
+				script: fmt.Sprintf(`const response = await fetch(url, {headers: {Cookie: cookie}, mode: %q, credentials: %q}); return response.text();`, mode, credentials),
+			})
+		}
+	}
+	for _, withCredentials := range []bool{false, true} {
+		tests = append(tests, requestTest{
+			name: fmt.Sprintf("XHR withCredentials=%t", withCredentials),
+			script: fmt.Sprintf(`return new Promise((resolve, reject) => {
+				const xhr = new XMLHttpRequest();
+				xhr.open("GET", url);
+				xhr.withCredentials = %t;
+				xhr.setRequestHeader("cOoKiE", cookie);
+				xhr.onload = () => resolve(xhr.responseText);
+				xhr.onerror = () => reject(new Error("XHR failed"));
+				xhr.send();
+			});`, withCredentials),
+		})
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			runtime := engine.NewEngine(nil)
+			t.Cleanup(runtime.Close)
+			const cookie = "sid=manual; token=provided"
+			value, err := runtime.RunString(fmt.Sprintf(`(async () => {
+				const url = %q;
+				const cookie = %q;
+				%s
+			})()`, server.URL, cookie, test.script))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if value != cookie {
+				t.Fatalf("server received Cookie %q, want %q", value, cookie)
+			}
+		})
+	}
+}
+
+func TestFetchExplicitCookieWithCookieJar(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		if request.URL.Path == "/seed" {
+			http.SetCookie(w, &http.Cookie{Name: "stored", Value: "jar", Path: "/"})
+		}
+		_, _ = w.Write([]byte(request.Header.Get("Cookie")))
+	}))
+	t.Cleanup(server.Close)
+	runtime := engine.NewEngine(nil)
+	t.Cleanup(runtime.Close)
+	value, err := runtime.RunString(fmt.Sprintf(`(async () => {
+		const url = %q;
+		await (await fetch(url + "/seed")).text();
+		const automatic = await (await fetch(url)).text();
+		const combined = await (await fetch(url, {headers: {Cookie: "manual=provided"}})).text();
+		const omitted = await (await fetch(url, {credentials: "omit", headers: {Cookie: "manual=provided"}})).text();
+		const empty = await (await fetch(url, {credentials: "omit"})).text();
+		return JSON.stringify({automatic, combined, omitted, empty});
+	})()`, server.URL))
+	if err != nil {
+		t.Fatal(err)
+	}
+	const want = `{"automatic":"stored=jar","combined":"manual=provided; stored=jar","omitted":"manual=provided","empty":""}`
+	if value != want {
+		t.Fatalf("unexpected CookieJar result: got %#v want %s", value, want)
+	}
+}
+
 func TestFetchResponseAndRequestCloneHaveIndependentBodies(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
 		if request.Method == http.MethodPost {