Unhandled QuotaExceededError in CookieStore.persist() can crash request handling

[sulthonzh]

Description

CookieStore.persist() calls localStorage.setItem() without a try/catch. If the storage quota is exceeded (common in long-running test suites or CI), the unhandled exception propagates up through storeResponseCookies → handleRequest, crashing the entire request handling pipeline.

Context

• File: src/core/utils/cookieStore.ts:82-95
• Component: Cookie persistence in browser environments

Current Behavior

private persist(): void {
  if (
    typeof localStorage === "undefined" ||
    typeof localStorage.setItem !== "function"
  ) {
    return
  }

  // ... build data array ...

  localStorage.setItem(this.#storageKey, JSON.stringify(data)) // Can throw QuotaExceededError
}

When localStorage is full, setItem throws a DOMException with QuotaExceededError. This is not caught, so it bubbles up through:

1. cookieStore.setCookie() → calls this.persist()
2. storeResponseCookies() → calls cookieStore.setCookie()
3. handleRequest() → calls storeResponseCookies()

This means a full localStorage kills all subsequent request handling.

Expected Behavior

Cookie persistence failure should be graceful — cookies should still work in-memory for the current session, and a console warning should be emitted.

Suggested Fix

  private persist(): void {
    if (
      typeof localStorage === "undefined" ||
      typeof localStorage.setItem !== "function"
    ) {
      return
    }

    const data: Array<SerializedCookie> = []
    const { idx } = this.#memoryStore

    for (const domain in idx) {
      for (const path in idx[domain]) {
        for (const key in idx[domain][path]) {
          data.push(idx[domain][path][key].toJSON())
        }
      }
    }

-   localStorage.setItem(this.#storageKey, JSON.stringify(data))
+   try {
+     localStorage.setItem(this.#storageKey, JSON.stringify(data))
+   } catch (error) {
+     // Gracefully handle storage quota errors.
+     // Cookies remain available in-memory for this session.
+     console.warn(
+       \`[msw] Failed to persist cookies to localStorage: \${error}\`
+     )
+   }
  }

Impact

• Severity: Medium — Affects long-running browser test suites where localStorage fills up over many test runs
• Current workaround: manually clear localStorage between tests, but this defeats the purpose of cookie persistence

Environment

• Browser environments with limited localStorage (~5MB)
• Long-running test suites with many cookie-heavy scenarios

Positively — happy to submit a PR if this is welcome.

[qybaihe]

I prepared a small patch for this in my fork, but GitHub is currently rejecting PR creation from my account for this repository (CreatePullRequest permission error).

Compare link: main...qybaihe:fix-2750-cookie-store-quota

The patch keeps cookies available in memory when localStorage.setItem() fails during CookieStore.persist(), instead of letting that persistence error interrupt request handling. I kept it silent to avoid logging on every request while storage remains full.

Validation run locally:

pnpm test:unit src/core/utils/cookieStore.test.ts --run
pnpm test:unit src/core/utils/internal/tryCatch.test.ts src/core/utils/cookieStore.test.ts --run
pnpm exec prettier --check src/core/utils/cookieStore.ts src/core/utils/cookieStore.test.ts
pnpm exec oxlint src/core/utils/cookieStore.ts src/core/utils/cookieStore.test.ts
pnpm test:unit --run
pnpm build

All of those passed. Happy to open the PR normally if the permission issue is resolved, or adjust the patch if maintainers prefer a different persistence-failure behavior.

[beanscg]

Bean Labs took a source pass. src/core/utils/cookieStore.ts calls this.persist() after setting a cookie, and persist() writes the serialized cookie data to localStorage.setItem(...) without a local guard around quota/storage exceptions.

A focused browser test could stub localStorage.setItem to throw QuotaExceededError, then assert request handling continues and cookie persistence degrades gracefully. That keeps the behavior scoped to the persistence layer rather than swallowing every cookie parsing or tough-cookie error.

No PR opened from this pass.