diff --git a/packages/qwik-auth/src/index.ts b/packages/qwik-auth/src/index.ts index b0293f8d75a..ff1a0551c2c 100644 --- a/packages/qwik-auth/src/index.ts +++ b/packages/qwik-auth/src/index.ts @@ -140,15 +140,21 @@ async function authAction( ...authOptions, skipCSRFCheck, }); + + const cookies: string[] = []; res.headers.forEach((value, key) => { - /** - * Do not set the header if already set accept in the case of set-cookie which is allowed - * https://httpwg.org/specs/rfc6265.html#rfc.section.3 - */ - if (!req.headers.has(key) || key === 'set-cookie') { + if (key === 'set-cookie') { + // while browsers would support setting multiple cookies, the fetch implementation does not, so we join them later. + cookies.push(value); + } else if (!req.headers.has(key)) { req.headers.set(key, value); } }); + + if (cookies.length > 0) { + req.headers.set('set-cookie', cookies.join(', ')); + } + fixCookies(req); try {