fix(nuxt): preserve multiple set-cookie headers - #9574
Conversation
🦋 Changeset detectedLatest commit: 3dbb19f The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
@BalajiSriraman is attempting to deploy a commit to the Clerk Production Team on Vercel. A member of the Team first needs to authorize it. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review. 📝 WalkthroughWalkthroughNuxt server middleware now collects Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to The middleware now preserves multiple authentication cookies instead of allowing later values to replace earlier ones, preventing incomplete session or handshake updates. No actionable merge-blocking risk remains after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Description
Fixes #9573
authenticateRequest()can return multipleSet-Cookiedirectives while completing a handshake or refreshing a session. The Nuxt middleware previously forwarded each directive with H3'ssetResponseHeader(), so every cookie replaced the one before it and only the final directive reached the browser.This change collects all authentication
Set-Cookievalues and forwards them to H3 as one array-valued response header. Other authentication headers keep the existing replacement behavior. The regression test demonstrates that both a handshake deletion and refreshed session cookie survive the middleware, while an ordinary auth header is still forwarded.Run
pnpm --filter @clerk/nuxt testto execute the regression and Nuxt type checks. The package suite passes 20 tests, andpnpm buildpasses all 24 monorepo build tasks on Node 24.15.0. A monorepo-widepnpm testrun completed all Nuxt tests but had two unrelated@clerk/uitests time out under parallel load; both passed when rerun directly (33 passed, 2 skipped, 2 todo).Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change