Skip to content

fix(runtime-sdk): preserve repeated response headers (multiple Set-Cookie) - #167

Open
whitphx wants to merge 2 commits into
cloudflare:mainfrom
whitphx:fix/asgi-duplicate-response-headers
Open

fix(runtime-sdk): preserve repeated response headers (multiple Set-Cookie)#167
whitphx wants to merge 2 commits into
cloudflare:mainfrom
whitphx:fix/asgi-duplicate-response-headers

Conversation

@whitphx

@whitphx whitphx commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Building a header object with Object.fromEntries(headers) drops repeated header contents.
For example, when a response endpoint returns the header like this,

Set-Cookie: session=eyJhbGciOi...; Path=/; HttpOnly; Secure
Set-Cookie: csrftoken=a8f5f167f4...; Path=/; Secure; SameSite=Lax

Through the current bridge, Object.fromEntries collapses the pair and the client receives only:

Set-Cookie: csrftoken=a8f5f167f4...; Path=/; Secure; SameSite=Lax

This PR fixes it by building the headers with the SDK's own _to_js_headers helper, which keeps them as a js.Headers.

pytest -k asgi in packages/runtime-sdk runs the workerd suite, which asserts both cookies survive the round trip.

@whitphx whitphx changed the title fix(runtime-sdk): preserve repeated response headers (multiple Set-Cookie) fix(runtime-sdk): preserve repeated response headers (multiple Set-Cookie) Aug 1, 2026

@ryanking13 ryanking13 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I left one comment about reusing the existing code, otherwise looks good to me.

Comment thread packages/runtime-sdk/src/asgi.py Outdated
@whitphx
whitphx force-pushed the fix/asgi-duplicate-response-headers branch from c1e2e40 to 0270d6b Compare August 6, 2026 18:37
@whitphx
whitphx requested a review from ryanking13 August 6, 2026 18:53
@whitphx
whitphx force-pushed the fix/asgi-duplicate-response-headers branch from 0270d6b to 67a8bce Compare August 10, 2026 05:25
Comment thread packages/runtime-sdk/tests/workerd-test/asgi/tests/test_asgi.py Outdated
…ookie`)

Object.fromEntries collapses repeated header names to the last value per
name, dropping all but one Set-Cookie. Build the response headers with
the SDK's own _to_js_headers helper, which keeps them as a js.Headers.
@whitphx
whitphx force-pushed the fix/asgi-duplicate-response-headers branch from 67a8bce to 44d42dc Compare August 11, 2026 06:33
…apper

response.headers exposes an http.client.HTTPMessage, whose get_all()
returns every value for a repeated name, so the test no longer reaches
through js_object.
@whitphx
whitphx requested a review from ryanking13 August 11, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants