Skip to content

test(node-fetch): re-enable the set-cookie header combining test - #5730

Merged
tsctx merged 1 commit into
nodejs:mainfrom
pacocartones:test/reenable-set-cookie-header-combining
Sep 3, 2026
Merged

test(node-fetch): re-enable the set-cookie header combining test#5730
tsctx merged 1 commit into
nodejs:mainfrom
pacocartones:test/reenable-set-cookie-header-combining

Conversation

@pacocartones

Copy link
Copy Markdown
Contributor

This relates to...

Nothing open. It removes an it.skip in test/node-fetch/main.js that has outlived its cause by about four years.

Rationale

should allow get all responses of a header was skipped in 7e085e0 (#1216, 2022-02-09) with a bare // TODO: fix test.. The reason it was failing is visible in the diff of that commit: it asserts that a response carrying two Set-Cookie headers exposes them combined,

const url = `${base}cookie`     // server sends res.setHeader('Set-Cookie', ['a=1', 'b=1'])
return fetch(url).then(res => {
  const expected = 'a=1, b=1'
  assert.strictEqual(res.headers.get('set-cookie'), expected)
  assert.strictEqual(res.headers.get('Set-Cookie'), expected)
})

and at that point filterResponse() dropped every forbidden response-header nameset-cookie included — from basic responses, so get('set-cookie') was null.

That filtering was removed three months later in bf6d5a1 (#1469, "feat: remove headers filtering", fixes #1262 / #1463). The test has been able to pass ever since; only the skip stayed behind.

Checked on both sides of that commit, with a small script driving a server that sends Set-Cookie: ['a=1', 'b=1']:

=== 0e64274 (bf6d5a1^) ===
get(set-cookie) = null
get(Set-Cookie) = null
=== bf6d5a1 ===
get(set-cookie) = "a=1, b=1"
get(Set-Cookie) = "a=1, b=1"

The assertion is still meaningful. A test that passes is not automatically a test that still checks something, so I broke the behaviour on purpose to confirm it is not vacuous. Making HeadersList.append in lib/web/fetch/headers.js keep only the first set-cookie instead of combining, with the test file untouched:

✖ should allow get all responses of a header (19.492838ms)
  AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:

  'a=1' !== 'a=1, b=1'

    actual: 'a=1',
    expected: 'a=1, b=1',

So it exercises the real header-combining path, and it fails when that path regresses.

Order-independence: it passes on its own (--test-name-pattern, 3/3) and inside the whole file (3/3).

On the other five skips in this file: they are left alone deliberately. All five use the chai-era expect(...).to.timeout global under /* global expect */; there is no such global under node:test, so unskipping one just gives ReferenceError: expect is not defined at main.js:1468. They need a rewrite against the current runner, not an unskip, and that does not belong in this PR.

Changes

test/node-fetch/main.js: it.skipit for should allow get all responses of a header, and the stale // TODO: fix test. above it removed. No source changes.

Before (node --test test/node-fetch/main.js):

ℹ tests 130
ℹ pass 124
ℹ fail 0
ℹ skipped 6

After:

ℹ tests 130
ℹ pass 125
ℹ fail 0
ℹ skipped 5

npm run test:node-fetch on the branch: tests 189 / pass 177 / fail 0 / skipped 12, exit code 0. npm run lint passes.

Features

N/A

Bug Fixes

N/A

Breaking Changes and Deprecations

N/A

Status

@codecov-commenter

codecov-commenter commented Aug 28, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.47%. Comparing base (ede2a74) to head (98b7f74).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #5730      +/-   ##
==========================================
+ Coverage   93.46%   93.47%   +0.01%     
==========================================
  Files         110      110              
  Lines       38939    38939              
==========================================
+ Hits        36394    36398       +4     
+ Misses       2545     2541       -4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

`should allow get all responses of a header` has been skipped since
7e085e0 ("fix(test): fix test skipping logic", nodejs#1216, 2022-02-09). The
reason was that at the time `fetch` stripped `set-cookie` from response
headers, so `res.headers.get('set-cookie')` returned `null` instead of
the combined `a=1, b=1`.

That was fixed three months later by bf6d5a1 ("feat: remove headers
filtering", nodejs#1469, fixes nodejs#1262), which removed the forbidden-response-
header filtering from `filterResponse`. Checked against both sides of
that commit with a small probe against a server sending
`Set-Cookie: ['a=1', 'b=1']`: at 0e64274 `get('set-cookie')` is `null`,
at bf6d5a1 it is `'a=1, b=1'`. The test has been passing ever since, but
the skip was never removed.

The assertion still exercises the library, not a constant: making
`HeadersList.append` keep only the first `set-cookie` instead of
combining makes it fail with `'a=1' !== 'a=1, b=1'`.

The other five `it.skip`s in this file are left as they are. They use
the chai-era `expect(...).to.timeout` global, which no longer exists
under `node:test` (`ReferenceError: expect is not defined`), so they
need a rewrite rather than an unskip.

Signed-off-by: Paco Cartones <pacocartones@users.noreply.github.com>
@pacocartones
pacocartones force-pushed the test/reenable-set-cookie-header-combining branch from 79511ca to 98b7f74 Compare September 2, 2026 05:33
@tsctx
tsctx merged commit 17117f6 into nodejs:main Sep 3, 2026
35 of 38 checks passed
@github-actions github-actions Bot mentioned this pull request Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Undici strips out set-cookie headers, even when "credentials: 'include'" is set

3 participants