As expected the second test I added in the first commit fails:

[info] PekkoHttpBadClientHandlingSpec
[info] Play should
...
[error]   x allow accessing cookies, session and flash from an error handler if headers are set (38 ms)
[error]    Left(cookies: Iterable() session: Session(Map()) flash: Flash(Map())) is Left but 'cookies: Iterable() session: Session(Map()) flash: Flash(Map())' != 'cookies: Map(PLAY_SESSION -> Cookie(PLAY_SESSION,*** PLAY_FLASH -> Cookie(PLAY_FLASH,*** session: Session(Map(sessionfoo -> sessionbar)) flash: Flash(Map(flashfoo -> flashbar))' (BadClientHandlingSpec.scala:138)
[error] Actual:   ...ies: []I[terabl]e([) s]e[ss]i[o]n[: Se]s[s]i[on(]M[]a[p()) ]f[lash: ]F[]l[ash(]M[ap())]
[error] Expected: ...ies: [Map(PLAY_SESS]I[ON -> Cooki]e([PLAY_SESSION,]e[yJhbGc]i[OiJIUzI1NiJ9.eyJkYXRhIjp7I]n[Nlc3Npb25mb28iOiJzZXNzaW9uYmFyIn0]s[Im5]i[ZiI6]M[Tc1MjY2ODA1NSwi]a[WF0IjoxNzUyNjY4MDU1]f[Q.HgN1CB4Oq]F[E7N]l[AwuOK]M[pn5733_wXq295wC]
[info] Total for specification PekkoHttpBadClientHandlingSpec

That is because the request that gets passed to the onClientError method of an error handler does not carry over any req.cookies, req.flash or req.session.

Actually, I studied the code quite intense and can not see any reason why we should not pass the cookies, flash and session also to that request. Technically it should not be a problem at all.
Actually many years ago when I was using Play for application development I had problems with that because I was not able read the session in the client error method (like to log the user, etc. - can't remember exactly)

fyi, the first test I added succeeds thanks to

• Make sure Cookies, Session, Flash always exists even if empty (backport #13407) by @mkurz #13412

Note to myself, implementation wise:

Either parsing a Pekko or Netty request fails, then the clientError method gets called:

• Pekko
• Netty

or parsing the raw Pekko or Netty requests succeeds, then Server.getHandlerFor(...) gets called (just see referenced code) and the first thing that method does is to "enrich" the request with the request id (if not set yet), the cookies, flash and session here.
I am very sure we can just to the same in the clientError method with the custom request target and request header we generate in that method.

I will not backport that to the stable branches, because even though I am like very sure this enhancement is good I do not think it's good for a patch release because it's a bit too much for just a patch.

In case this enhancement causes problems in the next Play major release, we could just revert this PR then.