Preserve Wget explicit cookies across redirect origins

Author: ZSeanYves

commands/wget/README.md

@@ -38,7 +38,8 @@ restoration, exact GNU progress and diagnostic bytes, and options outside the
 documented package help are not claimed.
 
 The current workspace lets an explicit `--header='Cookie: ...'` replace
-the outgoing jar cookie field, as in GNU Wget 1.25.0. The jar still receives
+the outgoing jar cookie field, including across origins, as in GNU Wget 1.25.0.
+The jar still receives
 response cookies. This correction is not included in published 0.2.0.
 Cookie matching includes host/domain boundaries, path order, Secure, Max-Age,
 Expires, replacement and deletion. Public-suffix database and IDNA behavior

commands/wget/main.mbt

@@ -340,6 +340,7 @@ async fn download_one(
           keep_output_on_not_modified=options.timestamping,
           cookie_jar?=jar,
           custom_cookie_mode=@netops.ReplaceStored,
+          custom_cookie_cross_origin=true,
           basic_credentials?=options.user.map(user => {
             user + ":" + options.password.unwrap_or("")
           }),

commands/wget/options.mbt

@@ -60,7 +60,7 @@ fn usage() -> String {
     #|      --password=PASSWORD         HTTP Basic password
     #|      --auth-no-challenge         send Basic credentials on every request, including redirects
     #|      --load-cookies=FILE         load a Netscape cookie jar
-    #|      --header='Cookie: ...'      replace the outgoing jar cookie field
+    #|      --header='Cookie: ...'      override jar cookies, including on redirects
     #|      --save-cookies=FILE         save persistent cookies
     #|      --keep-session-cookies      also save session cookies
     #|      --no-cookies                disable cookie storage

core/cli/catalog.mbt

@@ -205,7 +205,7 @@ pub fn command_catalog() -> Array[CommandContract] {
       ["duration"],
       exit_codes=[0, 124, 125, 126, 127],
     ),
-    // header + load-cookies: explicit Cookie replaces the outgoing jar field.
+    // header + load-cookies: explicit Cookie overrides jar fields across origins.
     contract("wget", Restricted, NoInput, ByteStream, [Network, FileWrite], [
       "append-output", "body-data", "body-file", "connect-timeout", "continue", "content-disposition",
       "header", "input-file", "max-redirect", "method", "no-check-certificate", "no-proxy",

core/netops/README.md

@@ -46,7 +46,9 @@ to replay an already consumed stdin body.
 The current workspace uses the public client's persistent headers and per-request
 headers as separate layers. `CustomCookieMode::SeparateFields` sends stored
 cookies before the explicit Cookie field (curl); `ReplaceStored` sends only the
-explicit field while continuing to receive cookies (wget). This corrects the
+explicit field while continuing to receive cookies (wget). Wget also enables
+`custom_cookie_cross_origin`; curl leaves it disabled, independently of Basic
+credential scope. This corrects the
 0.2.0 rejection without new FFI or a replacement HTTP transport. It does not
 provide arbitrary ordered repeated headers: each layer is still a map.
 The response cookies array preserves each Set-Cookie field.

core/netops/header_layers_wbtest.mbt

@@ -45,6 +45,7 @@ async test "Cookie jar and explicit header remain separate across redirects" {
             headers=[http_header("cOoKiE", "sid=explicit")],
             cookie_jar=jar,
             custom_cookie_mode=mode,
+            custom_cookie_cross_origin=mode is ReplaceStored,
             cookie_data="sid=ignored-when-custom-header",
             redirects=FollowRedirects(3),
           ),
@@ -66,7 +67,13 @@ async test "Cookie jar and explicit header remain separate across redirects" {
           },
         )
         assert_eq(cookies[1], cookies[0])
-        assert_eq(cookies[2], ["Cookie: sid=destination"])
+        assert_eq(
+          cookies[2],
+          match mode {
+            SeparateFields => ["Cookie: sid=destination"]
+            ReplaceStored => ["cOoKiE: sid=explicit"]
+          },
+        )
       }
     })
   })

core/netops/pkg.generated.mbti

@@ -26,7 +26,7 @@ pub fn retryable_failure(TransferErrorKind, Int?) -> Bool
 
 pub async fn transfer(String, TransferOutput, TransferOptions, observer? : async (TransferEvent) -> Unit) -> TransferResult
 
-pub fn transfer_options(request_method? : HttpMethod, headers? : Array[HttpHeader], body? : RequestBody, redirects? : RedirectPolicy, preserve_method_on_redirect? : Bool, verify_tls? : Bool, proxy_url? : String, connect_timeout_ms? : Int, idle_timeout_ms? : Int, max_time_ms? : Int, fail_on_http_error? : Bool, http_error_statuses? : Array[Int], resume_from? : Int64, keep_output_on_not_modified? : Bool, cookie_jar? : CookieJar, cookie_data? : String, custom_cookie_mode? : CustomCookieMode, basic_credentials? : String, basic_preemptive? : Bool, basic_credential_scope? : BasicCredentialScope) -> TransferOptions
+pub fn transfer_options(request_method? : HttpMethod, headers? : Array[HttpHeader], body? : RequestBody, redirects? : RedirectPolicy, preserve_method_on_redirect? : Bool, verify_tls? : Bool, proxy_url? : String, connect_timeout_ms? : Int, idle_timeout_ms? : Int, max_time_ms? : Int, fail_on_http_error? : Bool, http_error_statuses? : Array[Int], resume_from? : Int64, keep_output_on_not_modified? : Bool, cookie_jar? : CookieJar, cookie_data? : String, custom_cookie_mode? : CustomCookieMode, custom_cookie_cross_origin? : Bool, basic_credentials? : String, basic_preemptive? : Bool, basic_credential_scope? : BasicCredentialScope) -> TransferOptions
 
 pub fn url_host(String) -> String raise TransferError
 
@@ -177,6 +177,7 @@ pub(all) struct TransferOptions {
   cookie_jar : CookieJar?
   cookie_data : String?
   custom_cookie_mode : CustomCookieMode
+  custom_cookie_cross_origin : Bool
   basic_credentials : String?
   basic_preemptive : Bool
   basic_credential_scope : BasicCredentialScope

core/netops/transfer.mbt

@@ -102,6 +102,7 @@ fn filtered_headers(
   headers : ArrayView[HttpHeader],
   strip_sensitive : Bool,
   strip_entity : Bool,
+  keep_cookie? : Bool = false,
 ) -> Array[HttpHeader] {
   let result : Array[HttpHeader] = []
   for header in headers {
@@ -110,7 +111,7 @@ fn filtered_headers(
       (
         name == "authorization" ||
         name == "proxy-authorization" ||
-        name == "cookie"
+        (name == "cookie" && !keep_cookie)
       ) {
       continue
     }
@@ -792,7 +793,12 @@ pub async fn transfer(
         body,
         options.preserve_method_on_redirect,
       )
-      headers = filtered_headers(headers, cross_origin, strip_entity)
+      headers = filtered_headers(
+        headers,
+        cross_origin,
+        strip_entity,
+        keep_cookie=options.custom_cookie_cross_origin,
+      )
       request_method = next_method
       body = next_body
       parsed = next

core/netops/types.mbt

@@ -145,6 +145,7 @@ pub(all) struct TransferOptions {
   cookie_jar : CookieJar?
   cookie_data : String?
   custom_cookie_mode : CustomCookieMode
+  custom_cookie_cross_origin : Bool
   basic_credentials : String?
   basic_preemptive : Bool
   basic_credential_scope : BasicCredentialScope
@@ -169,6 +170,7 @@ pub fn transfer_options(
   cookie_jar? : CookieJar,
   cookie_data? : String,
   custom_cookie_mode? : CustomCookieMode = SeparateFields,
+  custom_cookie_cross_origin? : Bool = false,
   basic_credentials? : String,
   basic_preemptive? : Bool = true,
   basic_credential_scope? : BasicCredentialScope = InitialOrigin,
@@ -191,6 +193,7 @@ pub fn transfer_options(
     cookie_jar,
     cookie_data,
     custom_cookie_mode,
+    custom_cookie_cross_origin,
     basic_credentials,
     basic_preemptive,
     basic_credential_scope,

docs/adr/0005-transfer.md

@@ -40,6 +40,9 @@ The current workspace sends matching jar cookies through persistent client heade
 and an explicit curl `Cookie:` through per-request headers. async 0.22.1 emits
 these separately and in that order. Wget selects `ReplaceStored` so its explicit
 field replaces outgoing jar cookies without disabling response-cookie storage.
+Wget also forwards that explicit field across origins, as its 1.25.0 wire probe
+shows; curl removes it. An independent `custom_cookie_cross_origin` flag preserves
+this difference without changing Basic or custom Authorization handling.
 The earlier single-map rejection was too restrictive. A pure MoonBit raw TCP
 probe confirmed the public API path and compared curl 8.7.1 and Wget 1.25.0;
 core tests assert the wire fields and redirect behavior, and the shared CLI