[PR #297] [MERGED] fix: preserve multiple Set-Cookie headers in response merging #455

New issue

Closed

opened 2026-05-06 12:39:53 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:53 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/297
Author: @NathanDrake2406
Created: 3/6/2026
Status: ✅ Merged
Merged: 3/6/2026
Merged by: @james-elicx

Base: main ← Head: fix/set-cookie-header-flattening

📝 Commits (9)

3328cce fix: preserve multiple Set-Cookie headers in prod-server and worker entry
b4edd1a fix: address review feedback on Set-Cookie header preservation
25ca620 fix: apply Set-Cookie fix to example workers, remove redundant toLowerCase
858cc01 fix: add missing as string cast in deploy.ts middleware header collection
d7a65ef merge: resolve conflict with upstream/main
1543aaf refactor: extract mergeHeaders to shared vinext/server/worker-utils
a415c61 fix: array-accumulate Set-Cookie in config headers, fix JSDoc, add behavioral test
389ea4d fix: indentation in deploy.ts template, array-accumulate Set-Cookie in example workers
14f66c7 fix: remove as any casts in prod-server.ts, add Vary handling to example workers

📊 Changes

9 files changed (+335 additions, -79 deletions)

View changed files

➕ CLAUDE.md (+1 -0)
📝 examples/pages-router-cloudflare/worker/index.ts (+32 -22)
📝 examples/realworld-api-rest/worker/index.ts (+32 -22)
📝 packages/vinext/package.json (+4 -0)
📝 packages/vinext/src/deploy.ts (+50 -15)
📝 packages/vinext/src/server/prod-server.ts (+47 -17)
➕ packages/vinext/src/server/worker-utils.ts (+40 -0)
📝 tests/deploy.test.ts (+30 -3)
📝 tests/features.test.ts (+99 -0)

📄 Description

Summary

Fixes Set-Cookie headers being flattened to a single value in prod-server.ts and the generated Cloudflare worker entry (deploy.ts)
The Record<string, string> pattern caused multiple Set-Cookie values to be overwritten (last wins) or corrupted by comma-joining (breaking cookies with Expires dates)
Extracts mergeResponseHeaders() helper using getSetCookie() (Node 20+) to preserve array-valued Set-Cookie
Applies the same fix to the worker entry template in deploy.ts using the Headers API
Fixes both the API route path and the SSR page rendering path in prod-server

Fixes #295

Test plan

Added 4 unit tests for Set-Cookie preservation (mergeResponseHeaders + sendCompressed with array headers)
All 224 features tests pass
All 155 deploy tests pass
All 122 pages-router tests pass
Typecheck clean
Lint clean

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/297 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 3/6/2026 **Status:** ✅ Merged **Merged:** 3/6/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/set-cookie-header-flattening` --- ### 📝 Commits (9) - [`3328cce`](https://github.com/cloudflare/vinext/commit/3328cce7720645a891e62699eb1e83e10be886d4) fix: preserve multiple Set-Cookie headers in prod-server and worker entry - [`b4edd1a`](https://github.com/cloudflare/vinext/commit/b4edd1a1caf2a9171a6f2aeaf86c7fee4edafb6d) fix: address review feedback on Set-Cookie header preservation - [`25ca620`](https://github.com/cloudflare/vinext/commit/25ca62095f994425c79dced2030357658cc3a274) fix: apply Set-Cookie fix to example workers, remove redundant toLowerCase - [`858cc01`](https://github.com/cloudflare/vinext/commit/858cc01fe2cce2284192ad1d919ad0e5d419db94) fix: add missing as string cast in deploy.ts middleware header collection - [`d7a65ef`](https://github.com/cloudflare/vinext/commit/d7a65eff1e5213fc9766b1a037a155d95e4ff62d) merge: resolve conflict with upstream/main - [`1543aaf`](https://github.com/cloudflare/vinext/commit/1543aafcb95a00f7c1d201aa5f7591bce587d7e2) refactor: extract mergeHeaders to shared vinext/server/worker-utils - [`a415c61`](https://github.com/cloudflare/vinext/commit/a415c61f51e3e26bbdec13c110d2631ac8fb5b04) fix: array-accumulate Set-Cookie in config headers, fix JSDoc, add behavioral test - [`389ea4d`](https://github.com/cloudflare/vinext/commit/389ea4d3a63fcc770675f1f59b57deef9133c4d4) fix: indentation in deploy.ts template, array-accumulate Set-Cookie in example workers - [`14f66c7`](https://github.com/cloudflare/vinext/commit/14f66c77415a39ab4e674ae1853444cf915011d4) fix: remove as any casts in prod-server.ts, add Vary handling to example workers ### 📊 Changes **9 files changed** (+335 additions, -79 deletions) <details> <summary>View changed files</summary> ➕ `CLAUDE.md` (+1 -0) 📝 `examples/pages-router-cloudflare/worker/index.ts` (+32 -22) 📝 `examples/realworld-api-rest/worker/index.ts` (+32 -22) 📝 `packages/vinext/package.json` (+4 -0) 📝 `packages/vinext/src/deploy.ts` (+50 -15) 📝 `packages/vinext/src/server/prod-server.ts` (+47 -17) ➕ `packages/vinext/src/server/worker-utils.ts` (+40 -0) 📝 `tests/deploy.test.ts` (+30 -3) 📝 `tests/features.test.ts` (+99 -0) </details> ### 📄 Description ## Summary - Fixes Set-Cookie headers being flattened to a single value in `prod-server.ts` and the generated Cloudflare worker entry (`deploy.ts`) - The `Record<string, string>` pattern caused multiple Set-Cookie values to be overwritten (last wins) or corrupted by comma-joining (breaking cookies with `Expires` dates) - Extracts `mergeResponseHeaders()` helper using `getSetCookie()` (Node 20+) to preserve array-valued Set-Cookie - Applies the same fix to the worker entry template in `deploy.ts` using the `Headers` API - Fixes both the API route path and the SSR page rendering path in prod-server Fixes #295 ## Test plan - [x] Added 4 unit tests for Set-Cookie preservation (`mergeResponseHeaders` + `sendCompressed` with array headers) - [x] All 224 features tests pass - [x] All 155 deploy tests pass - [x] All 122 pages-router tests pass - [x] Typecheck clean - [x] Lint clean --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>