Astro Info

Astro                    v5.16.6
Vite                     v6.4.1
Node                     v20.11.0
System                   macOS (x64)
Package Manager          npm
Output                   server
Adapter                  @astrojs/node (v9.5.1)
Integrations             @astrojs/react (v4.4.2)
                         astro-auth
                         astro-compress (v2.3.8)

If this issue only occurs in one browser, which browser is a problem?

(SSR only)

Describe the Bug

When using AstroCookies.set() together with manually appending a Set-Cookie header via response.headers.append("set-cookie", ...) on the same request, the cookie set via AstroCookies.set() is missing from the final response.

// /src/pages/index.js
export const GET = context => {
  const response = new Response(null);

  response.headers.append("set-cookie", "key1=value1");
  context.cookies.set("key2", "value2");

  return response;
};

❯ curl -i 'http://localhost:4321'
HTTP/1.1 200 OK
Vary: Origin
set-cookie: key1=value1;
Date: Tue, 23 Dec 2025 06:18:36 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

What's the expected result?

Both cookies should be included in the response (i.e. both Set-Cookie headers should be present), regardless of whether they were set via context.cookies.set() or via response.headers.append().

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-jrmtwg2t-zw3m5g2w?file=src%2Fpages%2Findex.ts

Please try:

• curl -i "http://localhost:4321/?cookies=astro" (only Astro.cookies())
• curl -i "http://localhost:4321/?cookies=web" (only Headers.append())
• curl -i "http://localhost:4321/?cookies=both" (both)

Participation

• I am willing to submit a pull request for this issue.