Headless Browser Cookies Scoped to CDP Connection

Description and use

In Lightpanda, the cookie jar is scoped to the CDP connection, not the browser process. Sessions injected via one WebSocket are invisible to other processes. The fix is a relay that owns a single CDP connection, serializes all commands, and re‑injects cookies on browser restart, ensuring persistent authentication.

Problem

Automation agents on a VPS could not see injected login cookies because the headless browser’s cookie jar was scoped to the CDP connection, not the browser process.

Outcome

By routing all CDP commands through a single relay, session cookies persist across browser restarts and are visible to all agents, eliminating logged‑out bugs caused by per‑connection cookie jars.

Workflow

• 1. Build a relay that maintains one CDP WebSocket connection to Lightpanda.
• 2. Expose HTTP endpoints (e.g., POST /v1/cdp) that proxy CDP commands to the single connection.
• 3. Agents send all Network.setCookies, Page.navigate, Runtime.evaluate requests to the relay instead of directly to the browser.
• 4. On browser restart, the relay detects the dead connection, re‑establishes it, and re‑injects the last synced session cookies via Network.setCookies.
• 5. Strip any expires attribute from cookies before injection to avoid silent discards.
• 6. Optionally set Domain, Secure, httpOnly, and path=/ to avoid mismatches.

Evidence

The headless browser I use is Lightpanda, a Chromium-family build driven over the Chrome DevTools Protocol. Its cookie jar is scoped per CDP connection, not per browser process.

Source

The relay I built now owns the only CDP connection for its whole lifetime. Agents talk to it over plain HTTP on loopback.

Source

Injecting a cookie with an expires attribute was silently discarded — not rejected, just dropped.

Source