2031299 - Request sent with "Cookie: " in inspector (with missing info bubble) and "Cookie: [object Object]" in Copy cURL; document.cookie is a string

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect)

Description

[наб]

Attachment: 4d954ae6800f8daa[1].png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0

Steps to reproduce:

Clicked through a form on https://epit.podatki.gov.pl/. Same thing happens when just opening normally.

Actual results:

The site gave me

Bad Request - Request Too Long
HTTP Error 400. The size of the request headers is too long.

The inspector says "Cookie: " on a broken line (see attached); Copy cURL yields

curl 'https://epit.podatki.gov.pl/' \
  --compressed \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: pl,en-GB;q=0.9,en;q=0.8,en-US;q=0.7' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: [object Object]' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Sec-Fetch-Dest: document' \
  -H 'Sec-Fetch-Mode: navigate' \
  -H 'Sec-Fetch-Site: none' \
  -H 'Priority: u=0, i' \
  -H 'TE: trailers'

I haven't found a way to bypass HSTS so I haven't seen what goes on the wire.

In the console, typeof document.cookie == "string", document.cookie.length == 9597. Visual inspection doesn't show anything interesting.

Expected results:

Nightly 151.0a1 (2026-04-10) (64-bit)

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: Cookies' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Andrea Marchesini [:baku]]

Attachment: Bug 2031299 - Fix DevTols cookie header serialization for long cookies,

Comment 3

[Julian Descottes [:jdescottes]]

Michael: The patch attached to this bug accidentally landed on elm earlier today https://hg-edge.mozilla.org/projects/elm/rev/fdc66c1b534aa7f67aad58d71278fe3a5f3b6855

I'm relanding it on autoland now, but what should we do about the elm revision. Should it be backed out there? Can it cause any issue?

Comment 4

[Michael Froman [:mjf]]

I'll take care of it. Thank you for letting me know.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/6bd724cdcfaa
https://hg.mozilla.org/integration/autoland/rev/09eb75228c3b
Fix DevTols cookie header serialization for long cookies, r=jdescottes,devtools-reviewers

Comment 6

[amarc]

https://hg.mozilla.org/mozilla-central/rev/09eb75228c3b