From 332089eca99bcc0e5bcbb9befb9e2637e96b4f1c Mon Sep 17 00:00:00 2001
From: "Nolann B." <100787331+nolannbiron@users.noreply.github.com>
Date: Thu, 30 Jul 2026 10:06:17 +0200
Subject: [PATCH] Don't forward cookies through the OpenAPI Scalar proxy
 (#4451)

---
 .changeset/openapi-scalar-proxy-cookies.md        | 5 +++++
 packages/gitbook/src/routes/openapi-proxy.test.ts | 6 +++++-
 packages/gitbook/src/routes/openapi-proxy.ts      | 8 +++-----
 3 files changed, 13 insertions(+), 6 deletions(-)
 create mode 100644 .changeset/openapi-scalar-proxy-cookies.md

diff --git a/.changeset/openapi-scalar-proxy-cookies.md b/.changeset/openapi-scalar-proxy-cookies.md
new file mode 100644
index 000000000..a84756869
--- /dev/null
+++ b/.changeset/openapi-scalar-proxy-cookies.md
@@ -0,0 +1,5 @@
+---
+"gitbook": patch
+---
+
+Improve cookie handling in the OpenAPI "Test it" request proxy.
diff --git a/packages/gitbook/src/routes/openapi-proxy.test.ts b/packages/gitbook/src/routes/openapi-proxy.test.ts
index 639534092..7c0247565 100644
--- a/packages/gitbook/src/routes/openapi-proxy.test.ts
+++ b/packages/gitbook/src/routes/openapi-proxy.test.ts
@@ -179,6 +179,7 @@ describe('handleOpenAPIProxyRequest', () => {
                     referer: 'http://localhost:3000/docs',
                     'x-forwarded-for': '127.0.0.1',
                     accept: 'application/json',
+                    cookie: 'gitbook_visitor=secret',
                     'x-scalar-cookie': 'session=abc123',
                     'x-scalar-user-agent': 'ScalarClient/1.0',
                 },
@@ -192,7 +193,7 @@ describe('handleOpenAPIProxyRequest', () => {
         expect(headers.get('x-forwarded-for')).toBeNull();
         // Kept
         expect(headers.get('accept')).toBe('application/json');
-        // Remapped
+        // The browser's own cookie must not leak to the target; only the scalar cookie is sent.
         expect(headers.get('cookie')).toBe('session=abc123');
         expect(headers.get('user-agent')).toBe('ScalarClient/1.0');
         // Host set to target
@@ -208,6 +209,7 @@ describe('handleOpenAPIProxyRequest', () => {
                         'content-encoding': 'gzip',
                         'transfer-encoding': 'chunked',
                         'content-type': 'application/json',
+                        'set-cookie': 'evil=1; Domain=.gitbook.com; Path=/',
                     },
                 })
             )
@@ -222,6 +224,8 @@ describe('handleOpenAPIProxyRequest', () => {
         expect(res.headers.get('content-type')).toBe('application/json');
         expect(res.headers.get('content-encoding')).toBeNull();
         expect(res.headers.get('transfer-encoding')).toBeNull();
+        // A target must not be able to set cookies on GitBook's own origin.
+        expect(res.headers.get('set-cookie')).toBeNull();
     });
 
     it('returns 502 when upstream fetch fails', async () => {
diff --git a/packages/gitbook/src/routes/openapi-proxy.ts b/packages/gitbook/src/routes/openapi-proxy.ts
index bffe48ba3..d5364188f 100644
--- a/packages/gitbook/src/routes/openapi-proxy.ts
+++ b/packages/gitbook/src/routes/openapi-proxy.ts
@@ -18,6 +18,7 @@ const REQUEST_HEADERS_TO_STRIP = new Set([
     'origin',
     'referer',
     'connection',
+    'cookie',
     'x-scalar-cookie',
     'x-scalar-user-agent',
     'x-forwarded-for',
@@ -36,6 +37,7 @@ const RESPONSE_HEADERS_TO_STRIP = new Set([
     'transfer-encoding',
     'connection',
     'keep-alive',
+    'set-cookie',
 ]);
 
 const CORS_HEADERS = {
@@ -236,11 +238,7 @@ export async function handleOpenAPIProxyRequest(request: NextRequest): Promise<R
         for (const [key, value] of response.headers.entries()) {
             const lower = key.toLowerCase();
             if (!RESPONSE_HEADERS_TO_STRIP.has(lower) && !lower.startsWith('access-control-')) {
-                if (lower === 'set-cookie') {
-                    responseHeaders.append(key, value);
-                } else {
-                    responseHeaders.set(key, value);
-                }
+                responseHeaders.set(key, value);
             }
         }