fix(to-response): preserve multiple Set-Cookie when merging headers

Co-authored-by: Rastislav ₡ore <rastislav@onion.email>

Author: bytaesu

packages/better-call/src/to-response.test.ts

@@ -411,6 +411,89 @@ describe("toResponse", () => {
 		});
 	});
 
+	/**
+	 * @see https://github.com/better-auth/better-call/issues/118
+	 */
+	describe("multiple Set-Cookie preservation", () => {
+		it("preserves every Set-Cookie when merging init.headers onto an existing Response", () => {
+			const existing = new Response("ok");
+			existing.headers.append("set-cookie", "a=1; Path=/");
+			const initHeaders = new Headers();
+			initHeaders.append("set-cookie", "b=2; Path=/");
+			initHeaders.append("set-cookie", "c=3; Path=/");
+
+			const response = toResponse(existing, { headers: initHeaders });
+
+			expect(response.headers.getSetCookie()).toEqual([
+				"a=1; Path=/",
+				"b=2; Path=/",
+				"c=3; Path=/",
+			]);
+		});
+
+		it("preserves every Set-Cookie from init.headers in JSON-flag responses", () => {
+			const initHeaders = new Headers();
+			initHeaders.append("set-cookie", "a=1; Path=/");
+			initHeaders.append("set-cookie", "b=2; Path=/");
+
+			const response = toResponse(
+				{ _flag: "json", body: { ok: true } },
+				{ headers: initHeaders },
+			);
+
+			expect(response.headers.getSetCookie()).toEqual([
+				"a=1; Path=/",
+				"b=2; Path=/",
+			]);
+		});
+
+		it("preserves every Set-Cookie from data.headers in JSON-flag responses", () => {
+			const dataHeaders = new Headers();
+			dataHeaders.append("set-cookie", "a=1; Path=/");
+			dataHeaders.append("set-cookie", "b=2; Path=/");
+
+			const response = toResponse({
+				_flag: "json",
+				body: { ok: true },
+				headers: dataHeaders,
+			});
+
+			expect(response.headers.getSetCookie()).toEqual([
+				"a=1; Path=/",
+				"b=2; Path=/",
+			]);
+		});
+
+		it("preserves every Set-Cookie from routerResponse.headers in JSON-flag responses", () => {
+			const routerHeaders = new Headers();
+			routerHeaders.append("set-cookie", "a=1; Path=/");
+			routerHeaders.append("set-cookie", "b=2; Path=/");
+
+			const response = toResponse({
+				_flag: "json",
+				body: { ok: true },
+				routerResponse: { headers: routerHeaders },
+			});
+
+			expect(response.headers.getSetCookie()).toEqual([
+				"a=1; Path=/",
+				"b=2; Path=/",
+			]);
+		});
+
+		it("propagates non-cookie headers from routerResponse.headers in JSON-flag responses", () => {
+			const response = toResponse({
+				_flag: "json",
+				body: { ok: true },
+				routerResponse: {
+					headers: { "x-custom": "from-router" },
+				},
+			});
+
+			expect(response.headers.get("x-custom")).toBe("from-router");
+		});
+	});
+
 	describe("Request header stripping", () => {
 		const REQUEST_ONLY_HEADERS = [
 			// Request context (RFC 9110 §10.1)

packages/better-call/src/to-response.ts

@@ -139,14 +139,28 @@ function stripRequestOnlyHeaders(headers: Headers): void {
 	}
 }
 
+/**
+ * Copy headers from `source` into `target`. `Set-Cookie` is appended (one
+ * header per cookie) because RFC 9110 §5.3 notes it cannot be combined
+ * into a single comma-separated value; other headers are set (replace).
+ */
+function copyHeaders(target: Headers, source: HeadersInit | undefined): void {
+	if (!source) return;
+	for (const [key, value] of new Headers(source).entries()) {
+		if (key.toLowerCase() === "set-cookie") {
+			target.append(key, value);
+		} else {
+			target.set(key, value);
+		}
+	}
+}
+
 export function toResponse(data?: any, init?: ResponseInit): Response {
 	if (data instanceof Response) {
 		if (init?.headers) {
 			const safeHeaders = new Headers(init.headers);
 			stripRequestOnlyHeaders(safeHeaders);
-			safeHeaders.forEach((value, key) => {
-				data.headers.set(key, value);
-			});
+			copyHeaders(data.headers, safeHeaders);
 		}
 		return data;
 	}
@@ -158,23 +172,12 @@ export function toResponse(data?: any, init?: ResponseInit): Response {
 			return routerResponse;
 		}
 		const headers = new Headers();
-		if (routerResponse?.headers) {
-			const headers = new Headers(routerResponse.headers);
-			for (const [key, value] of headers.entries()) {
-				headers.set(key, value);
-			}
-		}
-		if (data.headers) {
-			for (const [key, value] of new Headers(data.headers).entries()) {
-				headers.set(key, value);
-			}
-		}
+		copyHeaders(headers, routerResponse?.headers);
+		copyHeaders(headers, data.headers);
 		if (init?.headers) {
 			const safeHeaders = new Headers(init.headers);
 			stripRequestOnlyHeaders(safeHeaders);
-			for (const [key, value] of safeHeaders.entries()) {
-				headers.set(key, value);
-			}
+			copyHeaders(headers, safeHeaders);
 		}
 
 		headers.set("Content-Type", "application/json");