Skip to content

fix(nuxt): preserve multiple set-cookie headers - #9574

Open
BalajiSriraman wants to merge 1 commit into
clerk:mainfrom
BalajiSriraman:fix/nuxt-preserve-set-cookie-headers
Open

fix(nuxt): preserve multiple set-cookie headers#9574
BalajiSriraman wants to merge 1 commit into
clerk:mainfrom
BalajiSriraman:fix/nuxt-preserve-set-cookie-headers

Conversation

@BalajiSriraman

Copy link
Copy Markdown

Description

Fixes #9573

authenticateRequest() can return multiple Set-Cookie directives while completing a handshake or refreshing a session. The Nuxt middleware previously forwarded each directive with H3's setResponseHeader(), so every cookie replaced the one before it and only the final directive reached the browser.

This change collects all authentication Set-Cookie values and forwards them to H3 as one array-valued response header. Other authentication headers keep the existing replacement behavior. The regression test demonstrates that both a handshake deletion and refreshed session cookie survive the middleware, while an ordinary auth header is still forwarded.

Run pnpm --filter @clerk/nuxt test to execute the regression and Nuxt type checks. The package suite passes 20 tests, and pnpm build passes all 24 monorepo build tasks on Node 24.15.0. A monorepo-wide pnpm test run completed all Nuxt tests but had two unrelated @clerk/ui tests time out under parallel load; both passed when rerun directly (33 passed, 2 skipped, 2 todo).

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@changeset-bot

changeset-bot Bot commented Aug 26, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 3dbb19f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@clerk/nuxt Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercel Bot commented Aug 26, 2026

Copy link
Copy Markdown

@BalajiSriraman is attempting to deploy a commit to the Clerk Production Team on Vercel.

A member of the Team first needs to authorize it.

@coderabbitai

coderabbitai Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: a1df1ad4-8f6c-4a7d-81e5-7c9ff39b8ccc

📥 Commits

Reviewing files that changed from the base of the PR and between 9c5e93c and 3dbb19f.

📒 Files selected for processing (3)
  • .changeset/calm-cookies-wait.md
  • packages/nuxt/src/runtime/server/__tests__/clerkMiddleware.test.ts
  • packages/nuxt/src/runtime/server/clerkMiddleware.ts
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • clerk/clerk_go (manual)
  • clerk/dashboard (manual)
  • clerk/accounts (manual)
  • clerk/backoffice (manual)
  • clerk/clerk (manual)
  • clerk/clerk-docs (manual)
  • clerk/cloudflare-workers (manual)

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.


📝 Walkthrough

Walkthrough

Nuxt server middleware now collects Set-Cookie values with getSetCookie() and writes them separately. Other authentication response headers continue to forward individually. A test verifies that two cookies and x-clerk-auth-status remain in the response. A changeset marks @clerk/nuxt for a patch release.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3dbb1

The middleware now preserves multiple authentication cookies instead of allowing later values to replace earlier ones, preventing incomplete session or handshake updates. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: wobsoriano

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the primary change: preserving multiple Set-Cookie headers in Nuxt middleware.
Description check ✅ Passed The description explains the Set-Cookie overwrite bug, the middleware fix, the regression test, and validation results. It is directly related to the changeset.
Linked Issues check ✅ Passed The changes satisfy issue #9573 by preserving multiple authentication Set-Cookie directives, forwarding other authentication headers normally, and adding a regression test for both behaviors.
Out of Scope Changes check ✅ Passed The changes are limited to the Nuxt middleware fix, its unit test, and the related patch changeset. No unrelated code changes are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(nuxt): repeated Set-Cookie headers are overwritten by clerkMiddleware

1 participant