garrytan/gstack · warning · Error

Cookie domain "${c.domain}" does not match current page doma

Error message

Cookie domain "${c.domain}" does not match current page domain "${defaultDomain}". Use the target site first.

What it means

Thrown by `browse cookie-import` when a cookie's explicit `domain` field does not match the current page hostname. The check normalizes a leading dot off the cookie domain, then requires either an exact match or that the page hostname ends with `.` + cookie domain (parent-domain match). This prevents importing cookies for site B while the browser is navigated to site A, which would be a cross-site cookie injection. The message directs the user to navigate to the target site first.

Source

Thrown at browse/src/write-commands.ts:674

      }
      if (!fs.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
      const raw = fs.readFileSync(filePath, 'utf-8');
      let cookies: any[];
      try { cookies = JSON.parse(raw); } catch (err: any) { throw new Error(`Invalid JSON in ${filePath}: ${err?.message || err}`); }
      if (!Array.isArray(cookies)) throw new Error('Cookie file must contain a JSON array');

      // Auto-fill domain from current page URL when missing (consistent with cookie command)
      const pageUrl = new URL(page.url());
      const defaultDomain = pageUrl.hostname;

      for (const c of cookies) {
        if (!c.name || c.value === undefined) throw new Error('Each cookie must have "name" and "value" fields');
        if (!c.domain) {
          c.domain = defaultDomain;
        } else {
          const cookieDomain = c.domain.startsWith('.') ? c.domain.slice(1) : c.domain;
          if (cookieDomain !== defaultDomain && !defaultDomain.endsWith('.' + cookieDomain)) {
            throw new Error(`Cookie domain "${c.domain}" does not match current page domain "${defaultDomain}". Use the target site first.`);
          }
        }
        if (!c.path) c.path = '/';
      }

      await page.context().addCookies(cookies);
      const importedDomains = [...new Set(cookies.map((c: any) => c.domain).filter(Boolean))];
      if (importedDomains.length > 0) bm.trackCookieImportDomains(importedDomains);
      return `Loaded ${cookies.length} cookies from ${filePath}`;
    }

    case 'cookie-import-browser': {
      // Two modes:
      // 1. Direct CLI import: cookie-import-browser <browser> --domain <domain> [--profile <profile>]
      //    Requires --domain (or --all to explicitly import everything).
      // 2. Open picker UI: cookie-import-browser [browser] (interactive domain selection)
      const browserArg = args[0];
      const domainIdx = args.indexOf('--domain');

View on GitHub (pinned to 94993f7401)

Solutions

1. Navigate to the target site first: `browse navigate https://target-site.com`, then re-run the import.
2. If the JSON contains cookies for multiple domains, split it by domain and import each batch after navigating to the matching site.
3. Omit the `domain` field from cookie objects — the command auto-fills it from the current page hostname, which always matches.
4. Confirm the cookie domain and page hostname agree up to a parent-domain suffix.

Example fix

// before (page is on about:blank)
await runBrowseCommand(['cookie-import', fp]); // fp has domain: 'target.com'

// after
await runBrowseCommand(['navigate', 'https://target.com']);
await runBrowseCommand(['cookie-import', fp]);

function domainsCompatible(cookieDomain: string, pageHostname: string): boolean {
  const d = cookieDomain.startsWith('.') ? cookieDomain.slice(1) : cookieDomain;
  return d === pageHostname || pageHostname.endsWith('.' + d);
}
function ensureCookiesMatchPage(cookies: any[], pageHostname: string): void {
  for (const c of cookies) {
    if (c.domain && !domainsCompatible(c.domain, pageHostname)) {
      throw new Error(`Cookie domain ${c.domain} does not match page ${pageHostname}`);
    }
  }
}

function cookieDomainMatchesPage(c: { domain?: string }, pageHostname: string): boolean {
  if (!c.domain) return true;
  const d = c.domain.startsWith('.') ? c.domain.slice(1) : c.domain;
  return d === pageHostname || pageHostname.endsWith('.' + d);
}

When it happens

Trigger: Browser is on `example.com` but the JSON contains a cookie with `domain: 'other-site.com'`; browser is on `app.example.com` and a cookie has `domain: 'example.com'` (this PASSES the parent check); browser is on `example.com` and a cookie has `domain: '.example.com'` (dot stripped, exact match, PASSES).

Common situations: User exported cookies from a browser session for site B and tries to import while still navigated to site A; the JSON contains cookies for multiple domains but the page is only on one of them; the user forgot the `browse navigate <url>` step before importing.

Related errors

• --domain "${domain}" does not match current page domain "${p
• Usage: browse cookie-import <json-file>
• File not found: ${filePath}
• Invalid JSON in ${filePath}: ${err?.message || err}
• Each cookie must have "name" and "value" fields

AI-assisted analysis of garrytan/gstack@94993f7401 (2026-08-12). Data as JSON: /api/errors/fbddd97348916c5c. Report an issue: GitHub.