From 3dbb19f0b3a116797d434395d802402e97e87b7f Mon Sep 17 00:00:00 2001
From: BalajiSriraman <96479581+BalajiSriraman@users.noreply.github.com>
Date: Wed, 26 Aug 2026 16:08:50 +0530
Subject: [PATCH] fix(nuxt): preserve multiple set-cookie headers

---
 .changeset/calm-cookies-wait.md               |  5 ++++
 .../server/__tests__/clerkMiddleware.test.ts  | 28 +++++++++++++++++++
 .../src/runtime/server/clerkMiddleware.ts     |  8 +++++-
 3 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/calm-cookies-wait.md

diff --git a/.changeset/calm-cookies-wait.md b/.changeset/calm-cookies-wait.md
new file mode 100644
index 00000000000..e9986c9f687
--- /dev/null
+++ b/.changeset/calm-cookies-wait.md
@@ -0,0 +1,5 @@
+---
+'@clerk/nuxt': patch
+---
+
+Preserve every cookie directive returned while authenticating server requests.
diff --git a/packages/nuxt/src/runtime/server/__tests__/clerkMiddleware.test.ts b/packages/nuxt/src/runtime/server/__tests__/clerkMiddleware.test.ts
index 99fa714d0a1..20bb3363827 100644
--- a/packages/nuxt/src/runtime/server/__tests__/clerkMiddleware.test.ts
+++ b/packages/nuxt/src/runtime/server/__tests__/clerkMiddleware.test.ts
@@ -113,6 +113,34 @@ describe('clerkMiddleware(params)', () => {
     expect(await response.json()).toEqual(SESSION_AUTH_RESPONSE);
   });
 
+  test('preserves multiple Set-Cookie headers returned by authenticateRequest', async () => {
+    const authHeaders = new Headers();
+    const cookies = [
+      '__clerk_handshake=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax',
+      '__session=refreshed; Path=/; HttpOnly; SameSite=Lax',
+    ];
+    cookies.forEach(cookie => authHeaders.append('set-cookie', cookie));
+    authHeaders.set('x-clerk-auth-status', 'signed-in');
+    authenticateRequestMock.mockResolvedValueOnce({
+      toAuth: () => SESSION_AUTH_RESPONSE,
+      headers: authHeaders,
+    });
+
+    const app = createApp();
+    const handler = toWebHandler(app);
+    app.use(clerkMiddleware());
+    app.use(
+      '/',
+      eventHandler(event => event.context.auth()),
+    );
+
+    const response = await handler(new Request(new URL('/', 'http://localhost')));
+
+    expect(response.status).toBe(200);
+    expect(response.headers.getSetCookie()).toEqual(cookies);
+    expect(response.headers.get('x-clerk-auth-status')).toBe('signed-in');
+  });
+
   test('executes handler and renders route when used with a custom handler', async () => {
     const app = createApp();
     const handler = toWebHandler(app);
diff --git a/packages/nuxt/src/runtime/server/clerkMiddleware.ts b/packages/nuxt/src/runtime/server/clerkMiddleware.ts
index aae8e02305f..848259c2674 100644
--- a/packages/nuxt/src/runtime/server/clerkMiddleware.ts
+++ b/packages/nuxt/src/runtime/server/clerkMiddleware.ts
@@ -136,9 +136,15 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]) => {
     }
 
     if (requestState.headers) {
+      const setCookieHeaders = requestState.headers.getSetCookie();
       requestState.headers.forEach((value, key) => {
-        setResponseHeader(event, key, value);
+        if (key.toLowerCase() !== 'set-cookie') {
+          setResponseHeader(event, key, value);
+        }
       });
+      if (setCookieHeaders.length > 0) {
+        setResponseHeader(event, 'set-cookie', setCookieHeaders);
+      }
     }
 
     const authObjectFn = (opts?: PendingSessionOptions) => requestState.toAuth(opts);