Preserve specified cookies between browser and gRPC UI

[gbargoud]

Adds a new flag to forward specified cookies between the browser and the gRPC UI.

This makes auth sessions easier to implement for a gRPC server by using the Set-Cookie header in the response and adding the appropriate preserve-cookie flag when launching grpcui.

See #438

Tested against an RPC server that uses cookies for auth sessions:

go build cmd/grpcui/grpcui.go && ./grpcui -preserve-cookie=session_id -preserve-cookie=user_id -plaintext 127.0.0.1:8000

---

Note

Medium Risk
Opt-in cookie forwarding touches auth/session paths; misconfiguration could leak or overwrite cookies, though names are explicitly allowlisted and full Cookie preservation via preserve-header still takes precedence.

Overview
Adds selective cookie forwarding so gRPC UI can carry cookie-based auth between the browser and the backend, similar to the existing preserve-header behavior but scoped by cookie name.

The grpcui CLI gains a repeatable -preserve-cookie flag; values are passed through standalone.PreserveCookies into InvokeOptions.PreserveCookies. On RPC invoke, matching cookies from the browser Cookie header are attached as gRPC metadata (unless -preserve-header Cookie already forwards the full header). After the RPC, Set-Cookie values from response metadata whose names are in the allowlist are written on the HTTP response so the browser can store session cookies from the server.

^{Reviewed by Cursor Bugbot for commit ed49a6f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit ed49a6f. Configure here.}

[cursor]

Set-Cookie trailers are not forwarded

Medium Severity

Preserved Set-Cookie values are copied only from results.Headers. Matching cookies in results.Trailers are ignored, so a session cookie sent as trailing metadata never reaches the browser and later RPCs stay unauthenticated.

 

^{Reviewed by Cursor Bugbot for commit ed49a6f. Configure here.}