What is the problem?

After running the GM_xmlhttpRequest, the cookie is overwritten when the server returns the Set-Cookie header.

How to reproduce it?

This bug can only be reproduce through the Chrome

1. User logs in to hello.example.com
2. hello.example.com returns Set-Cookie: PHPSESSID=20dxxx; path=/; domain=.example.com

3. // Getting data from the difference
   GM_xmlhttpRequest({
     url: 'https://world.example.com',
     anonymous: true,
     onload: () => console.log('do something cool')
   })

4. world.example.com returns Set-Cookie: PHPSESSID=5faxxx; path=/; domain=.example.com
5. PHPSESSID for .example.com is now 5faxxx

What is the expected result?

Completely ignoring Set-Cookie header

What is the actual result?

Set-Cookie overwrites cookies

Environment

• Browser: Chrome
• Browser version: 78.0.3904.108
• Violentmonkey version: 2.12.4
• OS: Windows 10