[PR #555] [MERGED] fix: align next/headers cookie path semantics #672

New issue

Closed

opened 2026-05-06 13:09:28 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:09:28 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/555
Author: @NathanDrake2406
Created: 3/16/2026
Status: ✅ Merged
Merged: 3/16/2026
Merged by: @james-elicx

Base: main ← Head: fix/cookies-path-default-delete-options

📝 Commits (2)

9a63baf Align next/headers cookie path semantics
2031626 Address cookie path review feedback

📊 Changes

4 files changed (+122 additions, -12 deletions)

View changed files

📝 packages/vinext/src/shims/headers.ts (+19 -7)
📝 tests/app-router.test.ts (+2 -2)
📝 tests/nextjs-compat/app-routes.test.ts (+2 -2)
📝 tests/shims.test.ts (+99 -1)

📄 Description

Summary

This aligns the mutable next/headers cookie shim with Next.js cookie semantics in two places: cookies().set() now defaults Path=/, and cookies().delete() now accepts an options object with path and domain.

What Changed

default cookies().set() to emit Path=/ when no path is provided
allow cookies().delete({ name, path, domain }) and emit an expired cookie header with those attributes
update existing delete expectations to match upstream expired-cookie semantics instead of assuming Max-Age=0
add regression coverage in tests/shims.test.ts for both behaviors

Why It Matters

Without the default path, cookies().set("name", "value") scopes the cookie to the current request path instead of /, which differs from Next.js and can break session visibility across routes. Without the object-form delete, vinext cannot reliably clear cookies that were originally set on a non-default path or domain.

Risks Or Limits

This only changes the mutable next/headers cookie surface in shims/headers.ts. It does not change NextResponse.cookies in next/server. The deletion header now uses an expired Expires= value, matching upstream ResponseCookies.delete() behavior.

Verification

./node_modules/.bin/vp test run tests/shims.test.ts -t "next/headers phase-aware cookies"
./node_modules/.bin/vp test run tests/nextjs-compat/app-routes.test.ts tests/nextjs-compat/set-cookies.test.ts tests/app-router.test.ts
git diff --check

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/555 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 3/16/2026 **Status:** ✅ Merged **Merged:** 3/16/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/cookies-path-default-delete-options` --- ### 📝 Commits (2) - [`9a63baf`](https://github.com/cloudflare/vinext/commit/9a63bafa733453aad31cd61e7ff6f4985179c4e0) Align next/headers cookie path semantics - [`2031626`](https://github.com/cloudflare/vinext/commit/203162607fbe84b3b537e1ee1d21ade065323e28) Address cookie path review feedback ### 📊 Changes **4 files changed** (+122 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/shims/headers.ts` (+19 -7) 📝 `tests/app-router.test.ts` (+2 -2) 📝 `tests/nextjs-compat/app-routes.test.ts` (+2 -2) 📝 `tests/shims.test.ts` (+99 -1) </details> ### 📄 Description ## Summary This aligns the mutable `next/headers` cookie shim with Next.js cookie semantics in two places: `cookies().set()` now defaults `Path=/`, and `cookies().delete()` now accepts an options object with `path` and `domain`. ## What Changed - default `cookies().set()` to emit `Path=/` when no path is provided - allow `cookies().delete({ name, path, domain })` and emit an expired cookie header with those attributes - update existing delete expectations to match upstream expired-cookie semantics instead of assuming `Max-Age=0` - add regression coverage in `tests/shims.test.ts` for both behaviors ## Why It Matters Without the default path, `cookies().set("name", "value")` scopes the cookie to the current request path instead of `/`, which differs from Next.js and can break session visibility across routes. Without the object-form delete, vinext cannot reliably clear cookies that were originally set on a non-default path or domain. ## Risks Or Limits This only changes the mutable `next/headers` cookie surface in `shims/headers.ts`. It does not change `NextResponse.cookies` in `next/server`. The deletion header now uses an expired `Expires=` value, matching upstream `ResponseCookies.delete()` behavior. ## Verification - `./node_modules/.bin/vp test run tests/shims.test.ts -t "next/headers phase-aware cookies"` - `./node_modules/.bin/vp test run tests/nextjs-compat/app-routes.test.ts tests/nextjs-compat/set-cookies.test.ts tests/app-router.test.ts` - `git diff --check` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>