From b1b7f6364f8ae109b3289a883e3c4733ec90d748 Mon Sep 17 00:00:00 2001
From: Anas Khan <83116240+anxkhn@users.noreply.github.com>
Date: Wed, 1 Jul 2026 09:36:21 +0530
Subject: [PATCH 1/2] fix: avoid double-spacing inconsistently delimited BiDi
 cookies

When only some cookie pairs lacked a space after the delimiter,
`replaceAll(';', '; ')` also expanded the already-correct `; ` into `;  `.
Normalize each delimiter to a single `; ` instead.
---
 packages/proxy/lib/http/request-middleware.ts |  2 +-
 .../test/unit/http/request-middleware.spec.ts | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/packages/proxy/lib/http/request-middleware.ts b/packages/proxy/lib/http/request-middleware.ts
index d9a3345f5b2..174ea6e4c04 100644
--- a/packages/proxy/lib/http/request-middleware.ts
+++ b/packages/proxy/lib/http/request-middleware.ts
@@ -126,7 +126,7 @@ const FormatCookiesIfApplicable: RequestMiddleware = function () {
     const bidiStyleCookie = /;\S/gm
 
     if (cookies.match(bidiStyleCookie)) {
-      this.req.headers.cookie = cookies.replaceAll(';', '; ')
+      this.req.headers.cookie = cookies.replace(/;\s*/g, '; ')
     }
   }
 
diff --git a/packages/proxy/test/unit/http/request-middleware.spec.ts b/packages/proxy/test/unit/http/request-middleware.spec.ts
index 7a9c144ede9..26d4b900259 100644
--- a/packages/proxy/test/unit/http/request-middleware.spec.ts
+++ b/packages/proxy/test/unit/http/request-middleware.spec.ts
@@ -325,6 +325,26 @@ describe('http/request-middleware', () => {
         expect(ctx.req.headers['cookie']).toEqual('foo=bar; bar=baz; qux=quux')
         expect(ctx.req.headers!['x-cypress-is-webdriver-bidi']).toBeUndefined()
       })
+
+      it('does not double-space cookies that are delimited inconsistently', async () => {
+        const ctx = {
+          req: {
+            headers: {
+              'x-cypress-is-webdriver-bidi': true,
+              cookie: 'foo=bar; bar=baz;qux=quux',
+            },
+          },
+          res: {
+            on: (event, listener) => {},
+            off: (event, listener) => {},
+          },
+        }
+
+        await testMiddleware([FormatCookiesIfApplicable], ctx)
+
+        expect(ctx.req.headers['cookie']).toEqual('foo=bar; bar=baz; qux=quux')
+        expect(ctx.req.headers!['x-cypress-is-webdriver-bidi']).toBeUndefined()
+      })
     })
   })
 

From 75a695346651c9261df75c5b6b557c0f0a860c8f Mon Sep 17 00:00:00 2001
From: Anas Khan <83116240+anxkhn@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:08:50 +0530
Subject: [PATCH 2/2] chore: add changelog entry

---
 cli/CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cli/CHANGELOG.md b/cli/CHANGELOG.md
index 0e0994d8834..d7c906e8bae 100644
--- a/cli/CHANGELOG.md
+++ b/cli/CHANGELOG.md
@@ -16,6 +16,7 @@
 - Fixed an issue where opening an unconfigured project from a git repository sub-directory (such as a monorepo package) skipped project setup. Additionally, the component testing setup wizard now reliably displays the auto-detected framework and bundler. Fixes [#27410](https://github.com/cypress-io/cypress/issues/27410) and [#29544](https://github.com/cypress-io/cypress/issues/29544). Fixed in [#34129](https://github.com/cypress-io/cypress/pull/34129) and [#34212](https://github.com/cypress-io/cypress/pull/34212).
 - Fixed an issue where interacting with an element inside a horizontally-scrollable container could scroll the element to the container's right edge, placing it underneath a right-floating `position: sticky` or `position: fixed` element and causing the action to fail or land on the wrong element. Elements are now scrolled to their top, leftmost point as documented. Fixes [#33884](https://github.com/cypress-io/cypress/issues/33884). Fixed in [#34108](https://github.com/cypress-io/cypress/pull/34108).
 - Fixed a regression in [15.17.0](#15-17-0) where `cypress run --spec` printed a spurious `The following --spec pattern did not match any spec files and will be ignored` warning for patterns that actually did match spec files, such as patterns using regex-style alternation groups (for example `cypress/e2e/(a|b)/*.js`). Fixes [#34160](https://github.com/cypress-io/cypress/issues/34160).
+- Fixed an issue where cookie headers forwarded through the proxy for WebDriver BiDi browsers could be normalized with inconsistent double spacing (for example `foo=bar;  bar=baz`) when the incoming header mixed spaced and unspaced delimiters. Delimiters are now normalized to a single `; `. Fixed in [#34207](https://github.com/cypress-io/cypress/pull/34207).
 
 **Dependency Updates:**