[PR #818] fix: strip Set-Cookie from App Route ISR cache entries #867

New issue

Open

opened 2026-05-06 13:10:33 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:33 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/818
Author: @southpolesteve
Created: 4/10/2026
Status: 🔄 Open

Base: main ← Head: fix/strip-set-cookie-from-app-route-isr-cache-clean

📝 Commits (1)

c88f837 fix: strip Set-Cookie from App Route ISR cache entries

📊 Changes

3 files changed (+39 additions, -4 deletions)

View changed files

📝 packages/vinext/src/server/app-route-handler-response.ts (+3 -4)
📝 tests/app-router.test.ts (+19 -0)
➕ tests/fixtures/app-basic/app/api/static-set-cookie/route.ts (+17 -0)

📄 Description

Summary

App Route ISR cache values no longer persist Set-Cookie headers.

Details

Cached App Route responses are shared across requests. Persisting Set-Cookie inside the ISR cache would replay per-request cookies to later visitors on HIT/STALE responses.

This change updates buildAppRouteCacheValue() to keep dropping:

set-cookie
x-vinext-cache
cache-control

Tests

Adds a dedicated cacheable route handler fixture (/api/static-set-cookie) with revalidate = 1 that sets Set-Cookie directly on the response.

Regression coverage verifies:

first request: MISS and Set-Cookie present
second request: HIT and Set-Cookie absent
body is still cached correctly across the HIT

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/818 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 4/10/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/strip-set-cookie-from-app-route-isr-cache-clean` --- ### 📝 Commits (1) - [`c88f837`](https://github.com/cloudflare/vinext/commit/c88f83729a51090ee3b68c4218144d8e337d7fd2) fix: strip Set-Cookie from App Route ISR cache entries ### 📊 Changes **3 files changed** (+39 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-route-handler-response.ts` (+3 -4) 📝 `tests/app-router.test.ts` (+19 -0) ➕ `tests/fixtures/app-basic/app/api/static-set-cookie/route.ts` (+17 -0) </details> ### 📄 Description ## Summary App Route ISR cache values no longer persist `Set-Cookie` headers. ## Details Cached App Route responses are shared across requests. Persisting `Set-Cookie` inside the ISR cache would replay per-request cookies to later visitors on HIT/STALE responses. This change updates `buildAppRouteCacheValue()` to keep dropping: - `set-cookie` - `x-vinext-cache` - `cache-control` ## Tests Adds a dedicated cacheable route handler fixture (`/api/static-set-cookie`) with `revalidate = 1` that sets `Set-Cookie` directly on the response. Regression coverage verifies: - first request: `MISS` and `Set-Cookie` present - second request: `HIT` and `Set-Cookie` absent - body is still cached correctly across the HIT --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>