req.session.save() overrides existing Set-Cookie header values

[mwisner]

https://github.com/vvo/next-iron-session/blob/master/lib/index.js#L62-L65

I "think" this line: res.setHeader("set-cookie", [cookieValue] is assuming that there were no other attempts to set cookies before calling req.session.save()

It looks like destroy does something similar: https://github.com/vvo/next-iron-session/blob/master/lib/index.js#L73

I think these calls don't seem to keep any existing values in the Set-Cookie header?

This doesn't seem to work:

const postHandler = async (req, res) => {
  destroyCookie({ req, res }, 'token');
  req.session.destroy();
  res.status(200).json({ message: 'logged out' }).end();
};

But this works fine:

const postHandler = async (req, res) => {
  req.session.destroy();
  destroyCookie({ req, res }, 'token');
  res.status(200).json({ message: 'logged out' }).end();
};

*destoyCookie comes from this package: https://github.com/maticzav/nookies which I am using to manage other cookies.

This kind of hung me up a little bit and required a fair bit of debugging and moving code around trying to understand why my extra cookies weren't being set.

[vvo]

@mwisner thanks for the report, I have been working on a fix for this. When this is released can you try again? Thanks!

[vvo]

🎉 This issue has been resolved in version 4.1.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[lkbr]

Hi there, I think #117 fixed req.session.save() but the change was never applied to req.session.destroy()which still seems to override attempts to set a cookies. Atleast for me.

[vvo]

(handling this in another issue @lkbr, solved)

[lkbr]

🙏