vercel / vercel/next.js

multi set-cookie merged into one header when cookie name is same

Open
#64,698 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Runtime
Dominant language
JavaScript
Stars
142k
Forks
32.4k
Avg merge
2d 14h
Merged PRs (30d)
351

Description

Link to the code that reproduces this issue

https://github.com/yeliex/stackblitz-starters-kfmrzz

To Reproduce
yarn
yarn dev

then open ${host}/api/test, open dev-tools or read terminal output, you would find set-cookie headers.

Current vs. Expected behavior
Expected
set-cookie: session=1713406956812; Path=/; Domain=.example1.com; Secure; HttpOnly; SameSite=none
set-cookie: session=1713406956812; Path=/; Domain=.example2.com; Secure; HttpOnly; SameSite=none
Current
## server response
set-cookie: session=1713406956812; Path=/; Domain=.example1.com; Secure; HttpOnly; SameSite=none, session=1713406956812; Path=/; Domain=.example2.com; Secure; HttpOnly; SameSite=none

## dev-tools response header
Set-Cookie: session=1713407480483; Path=/; Domain=.example2.com; Secure; HttpOnly; SameSite=none
Provide environment information
Operating System:
  Platform: linux
  Arch: x64
  Version: #1 SMP PREEMPT_DYNAMIC Sun Aug  6 20:05:33 UTC 2023
  Available memory (MB): 4102
  Available CPU cores: 2
Binaries:
  Node: 20.12.0
  npm: 10.5.0
  Yarn: 1.22.19
  pnpm: 8.15.6
Relevant Packages:
  next: 14.3.0-canary.9 // Latest available version is detected (14.3.0-canary.9).
  eslint-config-next: N/A
  react: 18.2.0
  react-dom: 18.2.0
  typescript: 5.2.2
Next.js Config:
  output: N/A
Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

next dev (local), Other (Deployed)

Additional context

when set multi cookie with same name, it would merged into one set-cookie header, then when response to client, only the last one remains

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked reproduction and run yarn followed by yarn dev, then request /api/test and inspect the server and browser response headers. Compare the result with the two expected separate Set-Cookie headers; done means cookies with the same name remain separate and the client receives both values.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, next.js, node.js
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.