How to clear httpOnly cookies using Puppeteer

This week I had an issue doing an implementation with Puppeteer. I had a httpOnly cookie doing some validation on the server that didn't leave me continue the process I was making.

If you don't know what an httpOnly cookie is, you can read this post: https://developer.mozilla.org/es/docs/Web/HTTP/Cookies#cookies_secure_y_httponly

Well, I found there's no way to erase it by using Javascript. So doing a JS code injection will not work. The only way to do this is by open the browser devtools and the clear it from there...

Then I found in Puppeter you can open a devtools instance! So, if you can open a devtools instance you can exploit it, right?

Yes, in Puppeteer is possible to clear the httpOnly cookies. By doing this:

async function browser(){
  const browser = await puppeteer.launch({
    headless: false,
    ignoreHTTPSErrors: true,
    args: [`--window-size=1800,1000`],
  });
  
  const page = await browser.newPage();
  // Using google as example, you can use your URL here
  await page.goto("https://google.com", {
    waitUntil: "load",
    timeout: 0,
  });
  // Create a client for CDP Session
  const client = await page.target().createCDPSession();
  // Send this string as the action to make in CDP session
  await client.send("Network.clearBrowserCookies");
  // All cookies are gone!
  console.log("all cookies are gone");

}

Well, this is the most short way to show this, so thanks for read.

Happy hacking!