[Response Headers]: set multiple headers of same key in response

I’ve a node-proxy server using node-fetch to get the data from server. The server responds with multiple set-cookie header. I want to add this to the response to the client. I first parsed using res.headers.raw()['set-cookie'] this gives me array of cookies but now I want to set it in response and I tried using set, append both of these methods just set the value in one header set-cookie separated by comma. Is there any way to have multiple set-cookie headers in response? set-cookie: cookie1=value1 set-cookie: cookie2=value2

[benjaminjkraft]

I want to highlight what @smolnikov said above – RFC 6265 says one SHOULD NOT do this for Set-Cookie specifically (and RFC 7230 echoes this as a special case). It’s acceptable for other headers, just not Set-Cookie. The browser fetch doesn’t need to care because it doesn’t let you see Set-Cookie at all.

That said, for anyone else reading this thread, it’s easy enough to work around by using headers.raw()['Set-Cookie'], which will give you a proper array of set-cookie values. (Except actually it’s a little more complicated than that, because you need to use the capitalization to match whatever the first time a set-cookie was added to this header. You can find this by iterating over headers.keys(), then using that name.) That’s what we’re doing.

[dzek69]

Looks like this is how standard is defined, try this in the browser console and you will get the stringified result too:

x = new Response()
x.headers.set("a", "1")
x.headers.append("a", "2")
x.headers.get("a")

node-fetch is mostly about following the specs

What’s interesting is that documentation on MDN is wrong and suggests an array being returned when appending another header: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch

console.log(myHeaders.get('X-Custom-Header')); // ['ProcessThisImmediately', 'AnotherValue']

But you can test yourself that’s not valid.

How to get around this? I have no idea. As you are controlling the response and not what’s reading it no “workaround” with splitting string is good here.

Probably using something else, more raw that is not following the Response/Headers standard is the only way to go.