[NEXT-645] Calling cookies.set twice sets only one value, in appdir route.ts

[raphaelbadia]

Verify canary release

• I verified that the issue exists in the latest Next.js canary release

Provide environment information

Operating System:
Platform: darwin
Arch: x64
Version: Darwin Kernel Version 22.3.0: Mon Jan 30 20:39:46 PST 2023; root:xnu-8792.81.3~2/RELEASE_ARM64_T6020
Binaries:
Node: 16.16.0
npm: 9.1.2
Yarn: 1.22.19
pnpm: 7.23.0
Relevant packages:
next: 13.2.1
eslint-config-next: N/A
react: 18.2.0
react-dom: 18.2.0

Which area(s) of Next.js are affected? (leave empty if unsure)

App directory (appDir: true), Middleware / Edge (API routes, runtime)

Link to the code that reproduces this issue

https://github.com/raphaelbadia/next-set-two-cookies-appdir-route

To Reproduce

clone the repository, run it, open the route /api (http://localhost:3000/api) , check the Network tab for the "cookie" request.

Describe the Bug

Calling "cookies.set" twice on an appdir api route will set only one cookie.

Expected Behavior

You'll see one "Set-Cookie" with 2 values, however it should be instead 2 "Set-Cookie" with only one value.

Set-Cookie can be repeated as many time as needed in an HTTP response to set multiple cookies.

Which browser are you using? (if relevant)

No response

How are you deploying your application? (if relevant)

No response

_NEXT-645

[raphaelbadia]

It is very much like #38302 , but in regular nodejs api route

[PHILLIPS71]

I've been running into the issue also and after doing some digging it's due to the set-cookie headers being appended, according to the Headers.append() method's documentation it states;

The append() method of the Headers interface appends a new value onto an existing header inside a Headers object, or adds the header if it does not already exist.

It's seems it's what's happening in this case here, calling append multiple times on a set-cookie header will append the new value as a comma separated string instead of adding an additional header.

The issues actually resides in https://github.com/vercel/edge-runtime at https://github.com/vercel/edge-runtime/blob/main/packages/cookies/src/response-cookies.ts#LL96

[benderillo]

I wonder if this issue being worked on. It currently blocks the work in NextAuth repo to support Route Handlers.

[raphaelbadia]

@timneutkens thanks for taking a look into the issue, but it's not fixed in the latest 13.2.4 😔 Please reopen it

[ManuelJustMobileSec]

+1 this is still happening. In my backend, I'm sending back to Next more than one set-cookie header and only the first one is being set.

[timneutkens]

Duplicate of #46579

[artemavrin]

I just checked
In middleware setting 2 cookies works as it should, but in app/route, it sets only the first value

[github-actions]

This closed issue has been automatically locked because it had no new activity for a month. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.