Summary
Network.getCookies omits cookies whose stored attributes are SameSite=None; Secure. The cookie is visible to the page (document.cookie) and was accepted via Network.setCookie, but it never appears in the CDP cookie list — a silent data loss for any CDP-based cookie inspection.
Environment
- moli 1.0.6, also verified on local build a1385e0 (main, 2026-08-30)
- Chromium baseline: chrome-headless-shell 131.0.6778.204, same CDP script
Reproduction (CDP)
Network.enableNetwork.setCookie {"name":"nonec","value":"1","domain":"127.0.0.1","path":"/","secure":true,"sameSite":"None"} → acceptedNetwork.getCookies {"urls":["http://127.0.0.1:8765/"]}
Observed (moli)
- Response
cookies list does not contain nonec
- Meanwhile in-page
document.cookie does contain nonec=1 — the cookie exists in the jar, only the CDP listing drops it
Expected (Chromium 131)
nonec is present in Network.getCookies results (Chrome lists all matching cookies regardless of SameSite/Secure attributes)
Impact
Silent, hard-to-debug loss for agent harnesses reading session state over CDP: SSO / cross-site cookies are precisely the ones commonly set with SameSite=None; Secure, and they're exactly the ones that go missing from the CDP view while the page itself still sees them.
Verified on a1385e0: C37_nonec_in_cdp: False — unchanged.
Summary
Network.getCookiesomits cookies whose stored attributes areSameSite=None; Secure. The cookie is visible to the page (document.cookie) and was accepted viaNetwork.setCookie, but it never appears in the CDP cookie list — a silent data loss for any CDP-based cookie inspection.Environment
Reproduction (CDP)
Network.enableNetwork.setCookie {"name":"nonec","value":"1","domain":"127.0.0.1","path":"/","secure":true,"sameSite":"None"}→ acceptedNetwork.getCookies {"urls":["http://127.0.0.1:8765/"]}Observed (moli)
cookieslist does not containnonecdocument.cookiedoes containnonec=1— the cookie exists in the jar, only the CDP listing drops itExpected (Chromium 131)
nonecis present inNetwork.getCookiesresults (Chrome lists all matching cookies regardless of SameSite/Secure attributes)Impact
Silent, hard-to-debug loss for agent harnesses reading session state over CDP: SSO / cross-site cookies are precisely the ones commonly set with
SameSite=None; Secure, and they're exactly the ones that go missing from the CDP view while the page itself still sees them.Verified on a1385e0:
C37_nonec_in_cdp: False— unchanged.