[dev] handle multiple value headers

[EverlastingBugstopper]

I'm unable to get wrangler dev to return multiple Set-Cookie headers in a worker response. I've tried in both of the following ways:

explicitly appending them

// not working, only last gets sent (`cookie2`)

resp.headers.append('Set-Cookie', 'cookie1=true')
resp.headers.append('Set-Cookie', 'cookie2=true')

passing them in the options object of the response

// not working, only last gets sent (`cookie2`)

headers: {
   'Set-Cookie': 'cookie1=true',
   'Set-Cookie': 'cookie2=true'
}

I've so far only been trying to get this to work using wrangler dev... perhaps it's a wider Workers issue/limitation? Perhaps I'm missing something obvious here?

Originally posted by @yet-another-dev in #1047 (comment)

---

The issue here is that we do not properly handle response headers that have multiple values. We iterate over them all and end up overwriting each response header with the following one, which is why @yet-another-dev only sees the last cookie header in the response

[EverlastingBugstopper]

further update - it looks like this is only a problem for Set-Cookie specifically. Other headers with multiple values are coalesed by the Workers Runtime into a single header field. If the key was my-header instead of Set-Cookie, it would look like my-header: value1, value2 and it wouldn't be a problem for wrangler dev to handle, since there will only ever be one my-header.

But Set-Cookie is special! From RFC 6265:

"Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. The usual mechanism for folding HTTP headers fields (i.e., as defined in [RFC2616]) might change the semantics of the Set-Cookie header field because the %x2C (",") character is used by Set-Cookie in a way that conflicts with such folding."

This means that Set-Cookie headers will be returned individually by the Workers Runtime, making wrangler dev's previous "insert not append" approach broken.

[Sharkgamedev]

I'm unable to get wrangler dev to return multiple Set-Cookie headers in a worker response. I've tried in both of the following ways:

explicitly appending them

// not working, only last gets sent (`cookie2`)

resp.headers.append('Set-Cookie', 'cookie1=true')
resp.headers.append('Set-Cookie', 'cookie2=true')

passing them in the options object of the response

// not working, only last gets sent (`cookie2`)

headers: {
   'Set-Cookie': 'cookie1=true',
   'Set-Cookie': 'cookie2=true'
}

I've so far only been trying to get this to work using wrangler dev... perhaps it's a wider Workers issue/limitation? Perhaps I'm missing something obvious here?

Originally posted by @yet-another-dev in #1047 (comment)

The issue here is that we do not properly handle response headers that have multiple values. We iterate over them all and end up overwriting each response header with the following one, which is why @yet-another-dev only sees the last cookie header in the response

Is this a problem again? I'm using the headers: { 'Set-Cookie': 'cookie1=true', 'Set-Cookie': 'cookie2=true' }
approach and It's only getting cookie2! Quite frustrating!

[Sharkgamedev]

UPDATE: When trying the resp.headers.apend(); method it works flawlessly so I assume this is a regression? I'm going to open a new issue.