[PR #598] [MERGED] fix: strip Set-Cookie headers from fetch cache entries #699

New issue

Closed

opened 2026-05-06 13:09:37 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:09:37 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/598
Author: @southpolesteve
Created: 3/19/2026
Status: ✅ Merged
Merged: 3/20/2026
Merged by: @southpolesteve

Base: main ← Head: fix/strip-set-cookie-from-fetch-cache

📝 Commits (1)

ebd76ed fix: strip Set-Cookie headers from fetch cache entries

📊 Changes

2 files changed (+35 additions, -0 deletions)

View changed files

📝 packages/vinext/src/shims/fetch-cache.ts (+4 -0)
📝 tests/fetch-cache.test.ts (+31 -0)

📄 Description

Summary

Fetch cache entries now exclude Set-Cookie response headers before storing.
Both the primary cache write path and the stale-while-revalidate background refresh path are fixed.
Adds a test verifying that the original response retains Set-Cookie but the cached response does not.

Details

When storing fetch responses in the cache, all response headers were included without filtering. Set-Cookie is a per-response header that should not persist in cache entries, since cached responses are shared across requests. The original (non-cached) response still includes the Set-Cookie header as expected.

Other non-cacheable headers like content-type and custom headers are preserved in the cache.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/598 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 3/19/2026 **Status:** ✅ Merged **Merged:** 3/20/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/strip-set-cookie-from-fetch-cache` --- ### 📝 Commits (1) - [`ebd76ed`](https://github.com/cloudflare/vinext/commit/ebd76eda7557eb31303555143e734ce4d6522c8b) fix: strip Set-Cookie headers from fetch cache entries ### 📊 Changes **2 files changed** (+35 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/shims/fetch-cache.ts` (+4 -0) 📝 `tests/fetch-cache.test.ts` (+31 -0) </details> ### 📄 Description ## Summary - Fetch cache entries now exclude `Set-Cookie` response headers before storing. - Both the primary cache write path and the stale-while-revalidate background refresh path are fixed. - Adds a test verifying that the original response retains `Set-Cookie` but the cached response does not. ## Details When storing fetch responses in the cache, all response headers were included without filtering. `Set-Cookie` is a per-response header that should not persist in cache entries, since cached responses are shared across requests. The original (non-cached) response still includes the `Set-Cookie` header as expected. Other non-cacheable headers like `content-type` and custom headers are preserved in the cache. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>