From e384156e66a20e64881b71c158db0abcb45e2268 Mon Sep 17 00:00:00 2001
From: Mustafa Mulla <mustafamulla765@gmail.com>
Date: Thu, 23 Jul 2026 12:24:38 +0530
Subject: [PATCH 1/2] add proxy cookie leak repro test

---
 tests/routes/proxy.test.ts | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/routes/proxy.test.ts b/tests/routes/proxy.test.ts
index 6ae45cf..618c14b 100644
--- a/tests/routes/proxy.test.ts
+++ b/tests/routes/proxy.test.ts
@@ -72,4 +72,34 @@ describe("proxy route", () => {
       mockServer.stop()
     }
   })
+
+  test("should not forward proxy-origin cookies to the target", async () => {
+    const { axios } = await getTestServer()
+
+    const mockServerPort = 4001
+    const mockServer = Bun.serve({
+      port: mockServerPort,
+      fetch(req) {
+        return Response.json({
+          cookie: req.headers.get("cookie"),
+        })
+      },
+    })
+
+    try {
+      const response = await axios.get("/proxy", {
+        headers: {
+          "X-Target-Url": `http://localhost:${mockServerPort}`,
+          "X-Sender-Cookie": "",
+          Cookie:
+            'ph_test_posthog={"distinct_id":"localhost-user","session_id":"localhost-session"}',
+        },
+      })
+
+      expect(response.status).toBe(200)
+      expect(response.data.cookie).toBeNull()
+    } finally {
+      mockServer.stop()
+    }
+  })
 })

From 4abfd314122fb3e9bed36ea724d2e5127bf6ac23 Mon Sep 17 00:00:00 2001
From: Mustafa Mulla <mustafamulla765@gmail.com>
Date: Thu, 23 Jul 2026 12:34:34 +0530
Subject: [PATCH 2/2] mark proxy cookie repro as expected failure

---
 tests/routes/proxy.test.ts | 53 ++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 25 deletions(-)

diff --git a/tests/routes/proxy.test.ts b/tests/routes/proxy.test.ts
index 618c14b..259b3aa 100644
--- a/tests/routes/proxy.test.ts
+++ b/tests/routes/proxy.test.ts
@@ -73,33 +73,36 @@ describe("proxy route", () => {
     }
   })
 
-  test("should not forward proxy-origin cookies to the target", async () => {
-    const { axios } = await getTestServer()
-
-    const mockServerPort = 4001
-    const mockServer = Bun.serve({
-      port: mockServerPort,
-      fetch(req) {
-        return Response.json({
-          cookie: req.headers.get("cookie"),
-        })
-      },
-    })
+  test.failing(
+    "should not forward proxy-origin cookies to the target",
+    async () => {
+      const { axios } = await getTestServer()
 
-    try {
-      const response = await axios.get("/proxy", {
-        headers: {
-          "X-Target-Url": `http://localhost:${mockServerPort}`,
-          "X-Sender-Cookie": "",
-          Cookie:
-            'ph_test_posthog={"distinct_id":"localhost-user","session_id":"localhost-session"}',
+      const mockServerPort = 4001
+      const mockServer = Bun.serve({
+        port: mockServerPort,
+        fetch(req) {
+          return Response.json({
+            cookie: req.headers.get("cookie"),
+          })
         },
       })
 
-      expect(response.status).toBe(200)
-      expect(response.data.cookie).toBeNull()
-    } finally {
-      mockServer.stop()
-    }
-  })
+      try {
+        const response = await axios.get("/proxy", {
+          headers: {
+            "X-Target-Url": `http://localhost:${mockServerPort}`,
+            "X-Sender-Cookie": "",
+            Cookie:
+              'ph_test_posthog={"distinct_id":"localhost-user","session_id":"localhost-session"}',
+          },
+        })
+
+        expect(response.status).toBe(200)
+        expect(response.data.cookie).toBeNull()
+      } finally {
+        mockServer.stop()
+      }
+    },
+  )
 })