[Windows] Repeated launches fail with Web authentication error after loopback Cookie header reaches 431

[qingtiannew]

Summary

On Windows, DSH Desktop 0.2.1-rc.5 can fail during startup after repeated launches with desktop welcome: Web authentication failed.

Confirmed cause

A Chromium NetLog from the failed launch showed Electron's request to the local Host (127.0.0.1:<ephemeral port>) carrying a Cookie header of about 16 KB. The Host responded with HTTP/1.1 431 Request Header Fields Too Large.

The DSH Chromium cookie database contained 71 cookies for 127.0.0.1 with names beginning dsh-auth- (about 15.9 KB of stored cookie data). Cookies are scoped to the host, not the port, so entries left by previous Host instances were sent to the new ephemeral port. The persistent Chromium cookie jar kept these entries across restarts. The Desktop code then surfaced the non-2xx net.fetch() response as the generic Web authentication failure.

Disabling all third-party bundles and launching with --no-proxy-server did not change the failure, isolating it to the Desktop/Host local-auth path.

Workaround verified

With DSH closed, back up the Chromium Network/Cookies SQLite database and remove only rows where host_key is 127.0.0.1 and the cookie name starts with dsh-auth-. After removing the 71 stale local-auth cookies, DSH started normally again with the original profile and plugins; no new Host crash log was produced.

Suggested fix

Clear obsolete loopback dsh-auth-* cookies before authenticating a new Host, or otherwise replace or clean old entries when a Host exits. Add a regression test that exercises repeated Host starts and verifies the auth request header stays below the server limit.

Environment

• Windows x64
• DSH Desktop 0.2.1-rc.5
• Electron 44.7.0
• Node 24.21.0