kwhitley / itty-router

A little router.
MIT License
1.69k stars 77 forks source link

multiple set-cookie headers are removed by corsify #223

Closed saviski closed 3 months ago

saviski commented 3 months ago

https://github.com/kwhitley/itty-router/blob/f1dda389484efef91e5bab8547de933fdb4ece3c/src/createCors.ts#L82

This line will remove repeated set-cookie headers if they are present in the response, leaving only the last set-cookie

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

To send multiple cookies, multiple Set-Cookie headers should be sent in the same response.

An workaround is to create a new Headers object from the original response.headers and add/append headers to it