redirect Response with multiple Set-Cookie headers

Author: birkskyum

.changeset/chilled-turkeys-leave.md

@@ -0,0 +1,5 @@
+---
+"@solidjs/start": patch
+---
+
+redirect Response with multiple Set-Cookie headers

packages/start/src/server/handler.ts

@@ -1,20 +1,20 @@
-import middleware from "solid-start:middleware";
 import { defineHandler, getCookie, H3, type H3Event, redirect, setCookie } from "h3";
 import { join } from "pathe";
 import type { JSX } from "solid-js";
 import { sharedConfig } from "solid-js";
 import { getRequestEvent, renderToStream, renderToString } from "solid-js/web";
+import middleware from "solid-start:middleware";
 
 import { createRoutes } from "../router.tsx";
 import { decorateHandler, decorateMiddleware } from "./fetchEvent.ts";
 import { getSsrManifest } from "./manifest/ssr-manifest.ts";
 import { matchAPIRoute } from "./routes.ts";
 import { handleServerFunction } from "./server-functions-handler.ts";
 import type {
-	APIEvent,
-	FetchEvent,
-	HandlerOptions,
-	PageEvent,
+  APIEvent,
+  FetchEvent,
+  HandlerOptions,
+  PageEvent,
 } from "./types.ts";
 import { getExpectedRedirectStatus } from "./util.ts";
 
@@ -235,15 +235,32 @@ function produceResponseWithEventHeaders(res: Response) {
 
   // Response.redirect returns an immutable value, so we clone on any redirect just in case
   if(300 <= res.status && res.status < 400) {
+    const cookies = res.headers.getSetCookie?.() ?? [];
+    const headers = new Headers();
+    res.headers.forEach((value, key) => {
+      if (key.toLowerCase() !== 'set-cookie') {
+        headers.set(key, value);
+      }
+    });
+    for (const cookie of cookies) {
+      headers.append('Set-Cookie', cookie);
+    }
     ret = new Response(res.body, {
       status: res.status,
       statusText: res.statusText,
-      headers: Object.fromEntries(res.headers.entries())
+      headers,
     });
   }
 
+  const eventCookies = event.response.headers.getSetCookie?.() ?? [];
+  for (const cookie of eventCookies) {
+    ret.headers.append('Set-Cookie', cookie);
+  }
+
   for(const [name, value] of event.response.headers) {
-    ret.headers.set(name, value);
+    if (name.toLowerCase() !== 'set-cookie') {
+      ret.headers.set(name, value);
+    }
   }
 
   return ret