{"record":{"id":"1f7539650d4605de","repo":"grafana/k6","slug":"cannot-set-cookies-w","errorCode":null,"errorMessage":"cannot set cookies: %w","messagePattern":"cannot set cookies: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/js/modules/k6/browser/common/browser_context.go","lineNumber":499,"sourceCode":"\t\t}\n\t\tcookiesToSet = append(cookiesToSet, &network.CookieParam{\n\t\t\tName:     c.Name,\n\t\t\tValue:    c.Value,\n\t\t\tDomain:   c.Domain,\n\t\t\tPath:     c.Path,\n\t\t\tURL:      c.URL,\n\t\t\tExpires:  ts,\n\t\t\tHTTPOnly: c.HTTPOnly,\n\t\t\tSecure:   c.Secure,\n\t\t\tSameSite: network.CookieSameSite(c.SameSite),\n\t\t})\n\t}\n\n\tsetCookies := storage.\n\t\tSetCookies(cookiesToSet).\n\t\tWithBrowserContextID(b.id)\n\tif err := setCookies.Do(cdp.WithExecutor(b.ctx, b.browser.conn)); err != nil {\n\t\treturn fmt.Errorf(\"cannot set cookies: %w\", err)\n\t}\n\n\treturn nil\n}\n\n// ClearCookies clears cookies.\nfunc (b *BrowserContext) ClearCookies() error {\n\tb.logger.Debugf(\"BrowserContext:ClearCookies\", \"bctxid:%v\", b.id)\n\n\tclearCookies := storage.\n\t\tClearCookies().\n\t\tWithBrowserContextID(b.id)\n\tif err := clearCookies.Do(cdp.WithExecutor(b.ctx, b.browser.conn)); err != nil {\n\t\treturn fmt.Errorf(\"clearing cookies: %w\", err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":481,"sourceCodeEnd":517,"githubUrl":"https://github.com/grafana/k6/blob/01ffac6f245854c1b8adc6a69857c76a15f90022/internal/js/modules/k6/browser/common/browser_context.go#L481-L517","documentation":"All cookies passed k6's client-side checks, but the CDP command Storage.setCookies (scoped to the browser context) rejected the batch. The wrapped error is Chromium's and typically names the first offending cookie, e.g. 'Failed to parse or set cookie named ...'. Causes are attributes CDP validates more strictly than k6's pre-checks.","triggerScenarios":"Secure cookies (secure: true) targeting an http:// origin; invalid sameSite values; illegal characters such as ';' or ',' in name/value; malformed domain syntax; an expires far out of range after unit mistakes (k6 treats expires as seconds since epoch — passing milliseconds yields an absurd date).","commonSituations":"Recording cookies from an HTTPS session and replaying against a local http:// server; hand-built sameSite strings; expires timestamps copied as JavaScript Date.now() (milliseconds) instead of epoch seconds.","solutions":["Read the wrapped CDP message — it names the failing cookie and reason; fix that attribute","Drop secure: true when targeting http:// origins, or serve the test over https","Use sameSite values 'Strict', 'Lax', or 'None' (None requires secure: true)","Express expires in seconds since epoch (Math.floor(Date.now()/1000)), not milliseconds","Remove ';', ',', and control characters from names and values"],"exampleFix":"// before\nctx.addCookies([{\n  name: 'session', value: 'abc',\n  domain: 'localhost', path: '/',\n  secure: true, // rejected: origin is http://localhost\n  expires: Date.now(), // milliseconds, parsed as far-future\n}]);\n\n// after\nctx.addCookies([{\n  name: 'session', value: 'abc',\n  domain: 'localhost', path: '/',\n  secure: false,\n  expires: Math.floor(Date.now() / 1000) + 3600,\n}]);","handlingStrategy":"validation","validationCode":"function normalizeCookie(c) {\n  return {\n    ...c,\n    expires: c.expires ? Math.floor(c.expires / 1000) : undefined, // ms -> s if needed\n    secure: c.secure !== undefined ? c.secure : false, // don't mark secure for http origins\n    sameSite: ['Strict', 'Lax', 'None'].includes(c.sameSite) ? c.sameSite : undefined,\n  };\n}\nconst cookies = rawCookies\n  .filter((c) => /^[^;,\\s]+$/.test(c.name) && /^[^;,]+$/.test(c.value)) // no ; or ,\n  .map(normalizeCookie);\nctx.addCookies(cookies);","typeGuard":"const isCdpSafeCookie = (c) =>\n  /^[^;,\\s]+$/.test(c.name) && /^[^;,]+$/.test(c.value)\n  && (c.sameSite === undefined || ['Strict', 'Lax', 'None'].includes(c.sameSite))\n  && !(c.secure === true && /^http:/.test(c.url || ''));","tryCatchPattern":"try {\n  ctx.addCookies(cookies);\n} catch (e) {\n  if (String(e.message).includes('cannot set cookies')) {\n    // wrapped CDP message names the offending cookie; fix or drop it and retry\n    const bad = cookies.find((c) => e.message.includes(`named '${c.name}'`));\n    if (bad) {\n      ctx.addCookies(cookies.filter((c) => c !== bad));\n    } else {\n      throw e;\n    }\n  } else {\n    throw e;\n  }\n}","preventionTips":["Don't set secure: true against http:// origins","Express expires as epoch seconds (Date.now()/1000), never milliseconds","Use only 'Strict'/'Lax'/'None' for sameSite, and 'None' only with secure","Keep ';' and ',' out of cookie names and values"],"tags":["browser","cdp","cookies","set-cookies"],"backgroundTag":"cdp-set-cookie-failed","analyzedSha":"01ffac6f245854c1b8adc6a69857c76a15f90022","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":"2026-08-18T03:05:52.393Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}