Repository navigation
fix(event-handler): keep Expires cookies and ALB headers intact - #5875
Merged
Merged
Conversation
Set-Cookie values were split on every comma, so a cookie with an Expires date reached the client as two broken cookies on API Gateway REST, HTTP API and ALB. Split only on a comma that starts another cookie, so cookies joined into one value are still separated. On ALB, headers were split between headers and multiValueHeaders, but ALB reads only one of the two depending on the target group's multi-value headers setting, so some headers were always lost. The router now detects the mode from the incoming event and returns every header in the field ALB reads. Direct callers of webResponseToProxyResult keep the previous output unless they pass the new multiValueHeaders option. Fixes #5874
svozza
approved these changes
Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Set-Cookievalues were split on every comma, so a cookie with anExpiresdate reached the client as two broken cookies on API Gateway REST, HTTP API and ALB. On ALB, response headers were split betweenheadersandmultiValueHeaders, but ALB reads only one of the two, so some headers were always lost in either target group mode. This PR fixes both without changing any response that works today. The remaining changes from #5674 stay there for the next major version.Changes
Set-Cookievalue only on a comma that starts another cookie (SET_COOKIE_SEPARATOR_REGEX), soExpiresdates stay intact whilea=1, b=2still becomes two cookies, for REST, ALB and HTTP API resultsmultiValueHeadersoption towebResponseToProxyResult.Router.resolve()sets it from whether the incoming ALB event hasmultiValueHeaders. Every header then goes, unchanged, into the one field ALB reads. Without the option, the output is unchanged for direct callersmultiValueHeadersas before, since ALB can't return several cookies in that mode, and document that multi-value headers must be enabled on the target group to set more than one cookiecreateTestALBEventmatch a real ALB event without multi-value headers, addcreateTestALBMultiValueEvent, and add round-trip tests for both cookie fixes and both ALB modes, plus a test that the converter's output is unchanged when the option isn't passedVerified on AWS (ALB in eu-west-1, Node.js 24):
multiValueHeadersexactly when the target group has multi-value headers enabled. The other field is absent, not empty./expiresreturns oneSet-Cookieheader with the full date,cache-control: no-store, privateandcontent-typeboth arrive, and CORS preflight headers arrive, in both modes. Two cookies arrive with multi-value headers on. With them off, ALB returns no cookies, the same as onmain.Issue number: closes #5874
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.