fix(nuxt): preserve multiple set-cookie headers

.changeset/calm-cookies-wait.md

@@ -0,0 +1,5 @@
+---
+'@clerk/nuxt': patch
+---
+
+Preserve every cookie directive returned while authenticating server requests.

packages/nuxt/src/runtime/server/__tests__/clerkMiddleware.test.ts

@@ -113,6 +113,34 @@ describe('clerkMiddleware(params)', () => {
     expect(await response.json()).toEqual(SESSION_AUTH_RESPONSE);
   });
 
+  test('preserves multiple Set-Cookie headers returned by authenticateRequest', async () => {
+    const authHeaders = new Headers();
+    const cookies = [
+      '__clerk_handshake=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax',
+      '__session=refreshed; Path=/; HttpOnly; SameSite=Lax',
+    ];
+    cookies.forEach(cookie => authHeaders.append('set-cookie', cookie));
+    authHeaders.set('x-clerk-auth-status', 'signed-in');
+    authenticateRequestMock.mockResolvedValueOnce({
+      toAuth: () => SESSION_AUTH_RESPONSE,
+      headers: authHeaders,
+    });
+
+    const app = createApp();
+    const handler = toWebHandler(app);
+    app.use(clerkMiddleware());
+    app.use(
+      '/',
+      eventHandler(event => event.context.auth()),
+    );
+
+    const response = await handler(new Request(new URL('/', 'http://localhost')));
+
+    expect(response.status).toBe(200);
+    expect(response.headers.getSetCookie()).toEqual(cookies);
+    expect(response.headers.get('x-clerk-auth-status')).toBe('signed-in');
+  });
+
   test('executes handler and renders route when used with a custom handler', async () => {
     const app = createApp();
     const handler = toWebHandler(app);

packages/nuxt/src/runtime/server/clerkMiddleware.ts

@@ -136,9 +136,15 @@ export const clerkMiddleware: ClerkMiddleware = (...args: unknown[]) => {
     }
 
     if (requestState.headers) {
+      const setCookieHeaders = requestState.headers.getSetCookie();
       requestState.headers.forEach((value, key) => {
-        setResponseHeader(event, key, value);
+        if (key.toLowerCase() !== 'set-cookie') {
+          setResponseHeader(event, key, value);
+        }
       });
+      if (setCookieHeaders.length > 0) {
+        setResponseHeader(event, 'set-cookie', setCookieHeaders);
+      }
     }
 
     const authObjectFn = (opts?: PendingSessionOptions) => requestState.toAuth(opts);