Fix cookie merging in Server Action redirections

[shuding]

This PR fixes the cookie merging logic in Server Actions. Specifically, when users do cookies().set(...) or cookies.delete(...) with a redirect() to an internal route followed. Currently, we are just concatenating the original cookies (request cookies) and the mutated cookies. That introduces several issues, like it can't override or delete an existing cookie.

Closes NEXT-2221

[ijjk]

Stats from current PR

Default Build

General Overall increase ⚠️

	vercel/next.js canary	vercel/next.js shu/af78	Change
buildDuration	11.6s	11.6s	N/A
buildDurationCached	5.9s	4.9s	N/A
nodeModulesSize	200 MB	200 MB	⚠️ +71.5 kB
nextStartRea..uration (ms)	427ms	430ms	N/A

Client Bundles (main, webpack)

	vercel/next.js canary	vercel/next.js shu/af78	Change
3f784ff6-HASH.js gzip	53.4 kB	53.4 kB	✓
423.HASH.js gzip	185 B	181 B	N/A
68-HASH.js gzip	29.8 kB	29.8 kB	N/A
framework-HASH.js gzip	45.2 kB	45.2 kB	✓
main-app-HASH.js gzip	238 B	240 B	N/A
main-HASH.js gzip	31.8 kB	31.8 kB	N/A
webpack-HASH.js gzip	1.7 kB	1.7 kB	✓
Overall change	100 kB	100 kB	✓

Legacy Client Bundles (polyfills)

	vercel/next.js canary	vercel/next.js shu/af78	Change
polyfills-HASH.js gzip	31 kB	31 kB	✓
Overall change	31 kB	31 kB	✓

Client Pages

	vercel/next.js canary	vercel/next.js shu/af78	Change
_app-HASH.js gzip	194 B	195 B	N/A
_error-HASH.js gzip	182 B	181 B	N/A
amp-HASH.js gzip	502 B	502 B	✓
css-HASH.js gzip	320 B	322 B	N/A
dynamic-HASH.js gzip	2.5 kB	2.5 kB	N/A
edge-ssr-HASH.js gzip	255 B	256 B	N/A
head-HASH.js gzip	350 B	349 B	N/A
hooks-HASH.js gzip	368 B	369 B	N/A
image-HASH.js gzip	4.18 kB	4.18 kB	N/A
index-HASH.js gzip	257 B	256 B	N/A
link-HASH.js gzip	2.61 kB	2.61 kB	N/A
routerDirect..HASH.js gzip	310 B	311 B	N/A
script-HASH.js gzip	384 B	383 B	N/A
withRouter-HASH.js gzip	306 B	308 B	N/A
1afbb74e6ecf..834.css gzip	106 B	106 B	✓
Overall change	608 B	608 B	✓

Client Build Manifests

	vercel/next.js canary	vercel/next.js shu/af78	Change
_buildManifest.js gzip	484 B	484 B	✓
Overall change	484 B	484 B	✓

Rendered Page Sizes

	vercel/next.js canary	vercel/next.js shu/af78	Change
index.html gzip	528 B	527 B	N/A
link.html gzip	541 B	540 B	N/A
withRouter.html gzip	523 B	522 B	N/A
Overall change	0 B	0 B	✓

Edge SSR bundle Size

	vercel/next.js canary	vercel/next.js shu/af78	Change
edge-ssr.js gzip	94 kB	94 kB	N/A
page.js gzip	149 kB	149 kB	N/A
Overall change	0 B	0 B	✓

Middleware size

	vercel/next.js canary	vercel/next.js shu/af78	Change
middleware-b..fest.js gzip	626 B	621 B	N/A
middleware-r..fest.js gzip	151 B	149 B	N/A
middleware.js gzip	37.6 kB	37.6 kB	N/A
edge-runtime..pack.js gzip	1.92 kB	1.92 kB	✓
Overall change	1.92 kB	1.92 kB	✓

Next Runtimes

	vercel/next.js canary	vercel/next.js shu/af78	Change
app-page-exp...dev.js gzip	170 kB	170 kB	N/A
app-page-exp..prod.js gzip	95.7 kB	95.7 kB	N/A
app-page-tur..prod.js gzip	96.3 kB	96.4 kB	N/A
app-page-tur..prod.js gzip	90.9 kB	90.9 kB	N/A
app-page.run...dev.js gzip	142 kB	142 kB	N/A
app-page.run..prod.js gzip	90.3 kB	90.3 kB	N/A
app-route-ex...dev.js gzip	22.2 kB	22.2 kB	✓
app-route-ex..prod.js gzip	14.9 kB	14.9 kB	✓
app-route-tu..prod.js gzip	14.9 kB	14.9 kB	✓
app-route-tu..prod.js gzip	14.5 kB	14.5 kB	✓
app-route.ru...dev.js gzip	21.6 kB	21.6 kB	✓
app-route.ru..prod.js gzip	14.5 kB	14.5 kB	✓
pages-api-tu..prod.js gzip	9.42 kB	9.42 kB	✓
pages-api.ru...dev.js gzip	9.69 kB	9.69 kB	✓
pages-api.ru..prod.js gzip	9.42 kB	9.42 kB	✓
pages-turbo...prod.js gzip	22 kB	22 kB	✓
pages.runtim...dev.js gzip	22.6 kB	22.6 kB	✓
pages.runtim..prod.js gzip	22 kB	22 kB	✓
server.runti..prod.js gzip	49.7 kB	49.7 kB	✓
Overall change	247 kB	247 kB	✓

Diff details

Diff for page.js

Diff too large to display

Diff for app-page-exp..ntime.dev.js

Diff too large to display

Diff for app-page-exp..time.prod.js

Diff too large to display

Diff for app-page-tur..time.prod.js

Diff too large to display

Diff for app-page-tur..time.prod.js

Diff too large to display

Diff for app-page.runtime.dev.js

Diff too large to display

Diff for app-page.runtime.prod.js

Diff too large to display

Commit: 2ad90ec

[ijjk]

Tests Passed

[ztanner]

I'm surprised that this test seems to be passing on canary without the changes in the PR, is there something more specific needed to trigger the buggy behavior?

[shuding]

That's very strange - during a manual testing of cookies().delete('foo') it didn't work.

[shuding]

@ztanner Okay I know what's happening! On an action redirection, cookies().delete('foo') only sets the value to '' (an empty string), not actually deleting it.

Here's a reproduction:

CleanShot.2024-01-26.at.21.32.04.mp4

After clicking on the button, that /2 route should display deleted instead of foo=. The client cookie was correctly updated as it worked after refreshing though.