{"record":{"id":"e80dfbab5ff8b117","repo":"projectdiscovery/nuclei","slug":"cookie-reuse-enabled-but-cookie-jar-is-nil","errorCode":null,"errorMessage":"cookie reuse enabled but cookie-jar is nil","messagePattern":"cookie reuse enabled but cookie-jar is nil","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/protocols/headless/request.go","lineNumber":159,"sourceCode":"\tdefer func() {\n\t\t_ = instance.Close()\n\t}()\n\n\tinstance.SetInteractsh(request.options.Interactsh)\n\n\tif _, err := url.Parse(input.MetaInput.Input); err != nil {\n\t\trequest.options.Output.Request(request.options.TemplatePath, input.MetaInput.Input, request.Type().String(), err)\n\t\trequest.options.Progress.IncrementFailedRequestsBy(1)\n\t\treturn errors.Wrap(err, errCouldNotGetHtmlElement)\n\t}\n\toptions := &engine.Options{\n\t\tTimeout:       time.Duration(request.options.Options.PageTimeout) * time.Second,\n\t\tDisableCookie: request.DisableCookie,\n\t\tOptions:       request.options.Options,\n\t}\n\n\tif !options.DisableCookie && input.CookieJar == nil {\n\t\treturn errors.New(\"cookie reuse enabled but cookie-jar is nil\")\n\t}\n\n\ttimeStart := time.Now()\n\tout, page, err := instance.Run(input, request.Steps, payloads, options)\n\trunDuration := time.Since(timeStart)\n\tif err != nil {\n\t\trequest.options.Output.Request(request.options.TemplatePath, input.MetaInput.Input, request.Type().String(), err)\n\t\trequest.options.Progress.IncrementFailedRequestsBy(1)\n\t\treturn errors.Wrap(err, errCouldNotGetHtmlElement)\n\t}\n\tdefer page.Close()\n\n\tpage.InteractshURLs = append(interactshURLs, page.InteractshURLs...)\n\n\treqLog := instance.GetRequestLog()\n\tnavigatedURL := request.getLastNavigationURLWithLog(reqLog) // also known as matchedURL if there is a match\n\n\trequest.options.Output.Request(request.options.TemplatePath, input.MetaInput.Input, request.Type().String(), nil)","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/protocols/headless/request.go#L141-L177","documentation":"Headless requests reuse session cookies across steps/templates unless the request sets DisableCookie: true, and that reuse requires a jar attached to the input context (input.CookieJar). If cookie reuse is enabled but the jar is nil, nuclei fails fast rather than silently running without session state. The CLI always builds inputs via contextargs constructors that create a jar, so this is essentially an SDK/embedding error.","triggerScenarios":"Embedding nuclei (lib/ or SDK) and constructing contextargs.Context with a struct literal or a constructor that skips CookieJar, then executing a headless template with default (enabled) cookie reuse. The CLI's NewWithInput/NewWithMetaInput always allocate a jar, so CLI users normally never see it.","commonSituations":"SDK users copying older example code that built Context{...} directly; tests creating bare inputs; custom input providers that bypass the provided constructors.","solutions":["Build inputs with contextargs.NewWithInput(ctx, targetURL) / NewWithMetaInput — they initialize the cookie jar","Or attach a jar manually: jar, _ := cookiejar.New(nil); ctx.CookieJar = jar","If the template does not need sessions, set `disable_cookie: true` on the headless request"],"exampleFix":"// before\nctx := &contextargs.Context{MetaInput: &contextargs.MetaInput{Input: url}}\n\n// after\nctx := contextargs.NewWithInput(context.Background(), url)","handlingStrategy":"validation","validationCode":"ctx := contextargs.NewWithInput(context.Background(), targetURL) // constructor initializes CookieJar\nif !request.DisableCookie && ctx.CookieJar == nil {\n    jar, _ := cookiejar.New(nil)\n    ctx.CookieJar = jar\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["In SDK code, never build contextargs.Context with a raw struct literal — use NewWithInput/NewWithMetaInput","If a template needs no sessions, set disable_cookie: true explicitly","Check input.CookieJar != nil before executing headless requests with cookie reuse enabled"],"tags":["headless","sdk","cookies","contextargs"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}