Multiple setCookie calls only set the last cookie

[GoncaloJoseMoura]

Environment

Nuxt Version: 4.1.3 (also tested with 3.14.159)
Nitro Version: 2.12.6
h3 Version: 1.15.4
Node Version: 20.x.x
Operating System: macOS
Package Manager: pnpm

Reproduction

Steps to reproduce

Create a fresh Nuxt project:

pnpm create nuxt@latest
cd nuxt-app
pnpm install

Create server/api/test.ts:

export default defineEventHandler(async (event) => {
  setCookie(event, "foo", "bar")
  setCookie(event, "monkey", "trial")
  setCookie(event, "good", "morning")
  
  console.log('Response headers:', event.node.res.getHeaders())
  
  return { ok: true }
})

Start the dev server:

pnpm dev

Test the endpoint:

curl -i http://localhost:3000/api/test

Describe the bug

Expected Behavior

The HTTP response should contain all three Set-Cookie headers:
HTTP/1.1 200 OK
Set-Cookie: foo=bar; Path=/
Set-Cookie: monkey=trial; Path=/
Set-Cookie: good=morning; Path=/

Actual Behavior

Only the last cookie is set:
HTTP/1.1 200 OK
set-cookie: good=morning; Path=/
However, the server console log shows all three cookies:

Response headers: {
  vary: 'Accept-Encoding',
  'set-cookie': [
    'foo=bar; Path=/',
    'monkey=trial; Path=/',
    'good=morning; Path=/'
  ]
}

Additional Testing

Raw Node.js server works correctly
Created a test with raw Node.js HTTP server (no Nuxt/Nitro):

const http = require('http');

const server = http.createServer((req, res) => {
  res.writeHead(200, {
    'Content-Type': 'application/json',
    'Set-Cookie': [
      'foo=bar; Path=/',
      'monkey=trial; Path=/',
      'good=morning; Path=/'
    ]
  });
  res.end(JSON.stringify({ ok: true }));
});

server.listen(3001);

Testing with curl -i http://localhost:3001 correctly shows all 3 cookies, confirming Node.js itself works fine.

Workarounds attempted (all failed)

1. Using setCookie with options:

setCookie(event, 'foo', 'bar', { path: '/', sameSite: 'lax' })

Using appendResponseHeader:

appendResponseHeader(event, 'Set-Cookie', 'foo=bar; Path=/')

2. Using setResponseHeaders with array:

setResponseHeaders(event, {
  'Set-Cookie': ['foo=bar', 'monkey=trial', 'good=morning']
})

3. Direct Node.js response manipulation:

event.node.res.setHeader('Set-Cookie', [...])

4. Using writeHead:

event.node.res.writeHead(200, {
  'Set-Cookie': [...]
})

None of these approaches work - only the last cookie is set.

Additional context

• Tested on both Nuxt 3.14.159 and 4.1.3 with identical results
• Tested in fresh projects with no additional configuration
• Tested with multiple HTTP clients (curl, Postman, browsers)
• Raw Node.js HTTP server works correctly, confirming this is specific to Nuxt/Nitro

Logs

[GoncaloJoseMoura]

Note: This is a Nuxt dev server quirk, production builds handle multiple cookies correctly.

[martin91s]

I'm glad I came across this. I'm having the same issue.

[ndrshn]

I'm having the same issue. Nuxt@4.1.2.

[Flo0806]

Hey! There’s an issue with sendWebResponse in the Nuxt CLI (nuxi). The .set function replaces all headers instead of adding them. I tested a quick fix locally and it seems to work, but I still need to check it properly and add some tests.
@danielroe Is it okay if I work on fixing this in the CLI?

.........~/projects/cli/packages/nuxi$ curl -i http://localhost:3000/api/test
HTTP/1.1 200 OK
set-cookie: foo=bar; Path=/
set-cookie: monkey=trial; Path=/
set-cookie: good=morning; Path=/
connection: close
content-length: 16
content-type: application/json
date: Tue, 07 Oct 2025 18:36:29 GMT
vary: Accept-Encoding

{
  "ok": true
....

[danielroe]

yes please! 🙌

[danielroe]

@Flo0806 I think it's just that we should call append instead of set here:

cli/packages/nuxi/src/dev/fetch.ts

Line 77 in 4509643

responseHeaders.set(key, Array.isArray(value) ? value.join(', ') : value)

[josuelrocha]

@danielroe

There's another issue (or perhaps the same issue). When updating to @nuxt/cli 3.29.2, the browser started issuing a warning:

So I investigated further and saw that the Set-Cookie is being sent incorrectly, because when there's more than one cookie, it's doing a .join(', '). Here's the raw header of how nuxt is sending it:

HTTP/1.1 200 OK
connection: close
content-length: [...]
content-type: text/html;charset=utf-8
date: Tue, 07 Oct 2025 22:50:44 GMT
set-cookie: XSRF-TOKEN=eyJpdiI6IlpDZ2JlTzdIY...IiwidGFnIjoiIn0%3D; expires=Wed, 08 Oct 2025 00:50:44 GMT; Max-Age=7200; path=/; domain=.domain.test; secure; samesite=lax, app-session=eyJpdiI6InpGNmxwR0t...xIiwidGFnIjoiIn0%3D; expires=Wed, 08 Oct 2025 00:50:44 GMT; Max-Age=7200; path=/; domain=.domain.test; secure; httponly; samesite=lax
vary: Accept-Encoding
x-powered-by: Nuxt

The correct thing to do is to use one Set-Cookie for each cookie:

HTTP/1.1 200 OK
connection: close
content-length: [...]
content-type: text/html;charset=utf-8
date: Tue, 07 Oct 2025 22:50:44 GMT
set-cookie: XSRF-TOKEN=eyJpdiI6IlpDZ2JlTzdIY...IiwidGFnIjoiIn0%3D; expires=Wed, 08 Oct 2025 00:50:44 GMT; Max-Age=7200; path=/; domain=.domain.test; secure; samesite=lax
set-cookie: app-session=eyJpdiI6InpGNmxwR0t...xIiwidGFnIjoiIn0%3D; expires=Wed, 08 Oct 2025 00:50:44 GMT; Max-Age=7200; path=/; domain=.domain.test; secure; httponly; samesite=lax
vary: Accept-Encoding
x-powered-by: Nuxt

[Flo0806]

Changing set to append was my solution, too. But I saw a lot more things that the h3 package do with cookies. I think we should handle cookies in the cli in a similar way to h3. There it is checked whether a cookie already exists and is only overwritten if necessary.

[ddavisj]

have same issue, thanks @Flo0806 for alerting me to this. hope we can get it fixed asap

[Flo0806]

@danielroe I hope I have fixed all issues in a future-proof way.