if the URL used to access XWiki is the same for the user's browser and the headless Chrome
BTW, this is the reason why the PDF export integration tests have not caught this problem: the browser used during the tests to trigger the export also runs in a Docker container, and it accesses XWiki using the "host.xwiki.internal" domain, which is the default value for "XWiki URI" configuration used by the PDF export (headless Chrome). So the PDF export tests were relying on the session cookie (it didn't matter if the username and password cookies were re-encoded or not).
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.