grafana/k6 · error

if cookie URL is not provided, both domain and path must be

Error message

if cookie URL is not provided, both domain and path must be specified: %#v

What it means

Validation error from BrowserContext.AddCookies: a cookie provided neither a url nor the domain+path pair. CDP cookie semantics require either an exact URL to scope the cookie, or explicit domain and path; k6 enforces this before the CDP call and rejects the whole request if any cookie violates it.

Source

Thrown at internal/js/modules/k6/browser/common/browser_context.go:474

	b.logger.Debugf("BrowserContext:AddCookies", "bctxid:%v", b.id)

	// skip work if no cookies provided.
	if len(cookies) == 0 {
		return fmt.Errorf("no cookies provided")
	}

	cookiesToSet := make([]*network.CookieParam, 0, len(cookies))
	for _, c := range cookies {
		if c.Name == "" {
			return fmt.Errorf("cookie name must be set: %#v", c)
		}
		if c.Value == "" {
			return fmt.Errorf("cookie value must be set: %#v", c)
		}
		// if URL is not set, both Domain and Path must be provided
		if c.URL == "" && (c.Domain == "" || c.Path == "") {
			const msg = "if cookie URL is not provided, both domain and path must be specified: %#v"
			return fmt.Errorf(msg, c)
		}
		// calculate the cookie expiration date, session cookie if not set.
		var ts *cdp.TimeSinceEpoch
		if c.Expires > 0 {
			t := cdp.TimeSinceEpoch(time.Unix(c.Expires, 0))
			ts = &t
		}
		cookiesToSet = append(cookiesToSet, &network.CookieParam{
			Name:     c.Name,
			Value:    c.Value,
			Domain:   c.Domain,
			Path:     c.Path,
			URL:      c.URL,
			Expires:  ts,
			HTTPOnly: c.HTTPOnly,
			Secure:   c.Secure,
			SameSite: network.CookieSameSite(c.SameSite),
		})

View on GitHub (pinned to 93accf6570)

Solutions

1. Prefer the simplest form: give the cookie a url, e.g. { name, value, url: 'https://example.com' }.
2. Alternatively provide both domain and path explicitly, e.g. { name, value, domain: 'example.com', path: '/' }.
3. When importing cookies from a HAR or another context, make sure each entry carries url or domain+path before passing it in.

Example fix

// before
context.addCookies([{ name: 'sid', value: '1', domain: 'example.com' }]); // no path, no url

// after
context.addCookies([{ name: 'sid', value: '1', url: 'https://example.com' }]);
// or: { name: 'sid', value: '1', domain: 'example.com', path: '/' }

function isValidCookieScoping(c) {
  const hasUrl = typeof c.url === 'string' && c.url !== '';
  const hasDomainAndPath =
    typeof c.domain === 'string' && c.domain !== '' &&
    typeof c.path === 'string' && c.path !== '';
  return hasUrl || hasDomainAndPath;
}
if (!cookies.every(isValidCookieScoping)) {
  throw new Error('each cookie needs "url" or both "domain" and "path"');
}
context.addCookies(cookies);

function isScopedCookie(c) {
  return (c.url != null && c.url !== '') ||
         (c.domain != null && c.domain !== '' && c.path != null && c.path !== '');
}

When it happens

Trigger: Calling browserContext.addCookies([{ name: 'sid', value: '1', domain: 'example.com' }]) (path missing), or with only url empty and only one of domain/path set, or with neither field at all.

Common situations: Porting Playwright cookie fixtures that use url only and accidentally dropping it; assuming domain alone is enough because that is common in other tools; building cookies from document.cookie strings (which lack domain/path scoping info) without adding them back.

Related errors

• no cookies provided
• cookie name must be set: %#v
• cookie value must be set: %#v
• filtering cookies: %w
• parsing urls: %w

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/f96691bdaab6f780. Report an issue: GitHub.