From 9068fe718ea96ddb8113c9d6f7ae09e9883faff6 Mon Sep 17 00:00:00 2001
From: Nikolay Govorov <me@govorov.online>
Date: Fri, 27 Mar 2026 11:16:46 +0000
Subject: [PATCH] Fix SameSite cookies

---
 src/browser/HttpClient.zig                | 4 +++-
 src/browser/Page.zig                      | 1 +
 src/browser/ScriptManager.zig             | 3 +++
 src/browser/webapi/net/Fetch.zig          | 1 +
 src/browser/webapi/net/XMLHttpRequest.zig | 1 +
 5 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/browser/HttpClient.zig b/src/browser/HttpClient.zig
index 546bcecd..ab3a808a 100644
--- a/src/browser/HttpClient.zig
+++ b/src/browser/HttpClient.zig
@@ -382,6 +382,7 @@ fn fetchRobotsThenProcessRequest(self: *Client, robots_url: [:0]const u8, req: R
             .blocking = false,
             .frame_id = req.frame_id,
             .cookie_jar = req.cookie_jar,
+            .cookie_origin = req.cookie_origin,
             .notification = req.notification,
             .resource_type = .fetch,
             .header_callback = robotsHeaderCallback,
@@ -923,6 +924,7 @@ pub const Request = struct {
     headers: http.Headers,
     body: ?[]const u8 = null,
     cookie_jar: ?*CookieJar,
+    cookie_origin: [:0]const u8,
     resource_type: ResourceType,
     credentials: ?[:0]const u8 = null,
     notification: *Notification,
@@ -1178,7 +1180,7 @@ pub const Transfer = struct {
         var aw: std.Io.Writer.Allocating = .init(self.arena.allocator());
         try jar.forRequest(self.req.url, &aw.writer, .{
             .is_http = true,
-            .origin_url = self.req.url,
+            .origin_url = self.req.cookie_origin,
             .is_navigation = self.req.resource_type == .document,
         });
         const written = aw.written();
diff --git a/src/browser/Page.zig b/src/browser/Page.zig
index e3c6bcac..03048a47 100644
--- a/src/browser/Page.zig
+++ b/src/browser/Page.zig
@@ -564,6 +564,7 @@ pub fn navigate(self: *Page, request_url: [:0]const u8, opts: NavigateOpts) !voi
         .headers = headers,
         .body = opts.body,
         .cookie_jar = &session.cookie_jar,
+        .cookie_origin = self.url,
         .resource_type = .document,
         .notification = self._session.notification,
         .header_callback = pageHeaderDoneCallback,
diff --git a/src/browser/ScriptManager.zig b/src/browser/ScriptManager.zig
index a43a39c6..0ebf222c 100644
--- a/src/browser/ScriptManager.zig
+++ b/src/browser/ScriptManager.zig
@@ -281,6 +281,7 @@ pub fn addFromElement(self: *ScriptManager, comptime from_parser: bool, script_e
             .headers = try self.getHeaders(),
             .blocking = is_blocking,
             .cookie_jar = &page._session.cookie_jar,
+            .cookie_origin = page.url,
             .resource_type = .script,
             .notification = page._session.notification,
             .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
@@ -405,6 +406,7 @@ pub fn preloadImport(self: *ScriptManager, url: [:0]const u8, referrer: []const
         .frame_id = page._frame_id,
         .headers = try self.getHeaders(),
         .cookie_jar = &page._session.cookie_jar,
+        .cookie_origin = page.url,
         .resource_type = .script,
         .notification = page._session.notification,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
@@ -510,6 +512,7 @@ pub fn getAsyncImport(self: *ScriptManager, url: [:0]const u8, cb: ImportAsync.C
         .ctx = script,
         .resource_type = .script,
         .cookie_jar = &page._session.cookie_jar,
+        .cookie_origin = page.url,
         .notification = page._session.notification,
         .start_callback = if (log.enabled(.http, .debug)) Script.startCallback else null,
         .header_callback = Script.headerCallback,
diff --git a/src/browser/webapi/net/Fetch.zig b/src/browser/webapi/net/Fetch.zig
index 2db4eab8..77a52e50 100644
--- a/src/browser/webapi/net/Fetch.zig
+++ b/src/browser/webapi/net/Fetch.zig
@@ -95,6 +95,7 @@ pub fn init(input: Input, options: ?InitOpts, page: *Page) !js.Promise {
         .headers = headers,
         .resource_type = .fetch,
         .cookie_jar = &page._session.cookie_jar,
+        .cookie_origin = page.url,
         .notification = page._session.notification,
         .start_callback = httpStartCallback,
         .header_callback = httpHeaderDoneCallback,
diff --git a/src/browser/webapi/net/XMLHttpRequest.zig b/src/browser/webapi/net/XMLHttpRequest.zig
index 8f0e8af2..d47ef71f 100644
--- a/src/browser/webapi/net/XMLHttpRequest.zig
+++ b/src/browser/webapi/net/XMLHttpRequest.zig
@@ -235,6 +235,7 @@ pub fn send(self: *XMLHttpRequest, body_: ?[]const u8) !void {
         .frame_id = page._frame_id,
         .body = self._request_body,
         .cookie_jar = if (cookie_support) &page._session.cookie_jar else null,
+        .cookie_origin = page.url,
         .resource_type = .xhr,
         .notification = page._session.notification,
         .start_callback = httpStartCallback,