[fix] handle set-cookie in setHeaders

Fixes #6032

Author: dummdidumm

.changeset/lemon-kids-double.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+handle `set-cookie` in `setHeaders`

packages/kit/src/runtime/server/index.js

@@ -143,12 +143,28 @@ export async function respond(request, options, state) {
 				const lower = key.toLowerCase();
 
 				if (lower in headers) {
-					throw new Error(`"${key}" header is already set`);
+					if (lower === 'set-cookie') {
+						if (!Array.isArray(headers[lower])) {
+							headers[lower] = [/**@type{string} */ (headers[lower])];
+						}
+						const cookies = /**@type{string[]} */ (headers[lower]);
+						const new_cookies = /**@type{string[]} */ (
+							Array.isArray(new_headers[key]) ? new_headers[key] : [new_headers[key]]
+						);
+						for (const new_cookie of new_cookies) {
+							if (cookies.includes(new_cookie)) {
+								throw new Error(`"${key}" header already has cookie with same value`);
+							}
+							cookies.push(new_cookie);
+						}
+					} else {
+						throw new Error(`"${key}" header is already set`);
+					}
+				} else {
+					// TODO apply these headers to the response <- is this TODO outdated?
+					headers[lower] = new_headers[key];
 				}
 
-				// TODO apply these headers to the response
-				headers[lower] = new_headers[key];
-
 				if (state.prerendering && lower === 'cache-control') {
 					state.prerendering.cache = /** @type {string} */ (new_headers[key]);
 				}

packages/kit/test/apps/basics/src/routes/headers/set-cookie/+layout.server.js

@@ -0,0 +1,5 @@
+export function load({ setHeaders }) {
+	setHeaders({
+		'set-cookie': 'cookie1=value1'
+	});
+}

packages/kit/test/apps/basics/src/routes/headers/set-cookie/+layout.svelte

@@ -0,0 +1 @@
+<slot />

packages/kit/test/apps/basics/src/routes/headers/set-cookie/sub/+page.server.js

@@ -0,0 +1,5 @@
+export function load({ setHeaders }) {
+	setHeaders({
+		'set-cookie': 'cookie2=value2'
+	});
+}

packages/kit/test/apps/basics/src/routes/headers/set-cookie/sub/+page.svelte

@@ -314,6 +314,14 @@ test.describe('Static files', () => {
 	});
 });
 
+test.describe('setHeaders', () => {
+	test('allows multiple set-cookie headers with different values', async ({ page }) => {
+		const response = await page.goto('/headers/set-cookie/sub');
+		const cookies = (await response?.allHeaders())['set-cookie'];
+		expect(cookies.includes('cookie1=value1') && cookies.includes('cookie2=value2')).toBe(true);
+	});
+});
+
 test.describe('Miscellaneous', () => {
 	test('does not serve version.json with an immutable cache header', async ({ request }) => {
 		// this isn't actually a great test, because caching behaviour is down to adapters.