From 41325e5f127d9910151da6bf7a5a3f83c90414bb Mon Sep 17 00:00:00 2001
From: Xia Chao <236466140+bun-unsafe@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:11:37 +0800
Subject: [PATCH] fix(response): preserve native response cookies

---
 src/response.ts        | 12 +++++++++++-
 tests/response.spec.ts | 43 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/src/response.ts b/src/response.ts
index 053b8af..ad0f7a5 100644
--- a/src/response.ts
+++ b/src/response.ts
@@ -861,7 +861,17 @@ export class HttpResponse extends Macroable {
    */
   send(body: any, generateEtag: boolean = this.#config.etag): void {
     if (body instanceof Response) {
-      body.headers.forEach((value, key) => this.header(key, value))
+      body.headers.forEach((value, key) => {
+        if (key !== 'set-cookie') {
+          this.header(key, value)
+        }
+      })
+
+      const cookies = body.headers.getSetCookie()
+      if (cookies.length) {
+        this.append('set-cookie', cookies)
+      }
+
       this.safeStatus(body.status)
 
       if (body.body) {
diff --git a/tests/response.spec.ts b/tests/response.spec.ts
index 9913685..745c2a7 100644
--- a/tests/response.spec.ts
+++ b/tests/response.spec.ts
@@ -1608,4 +1608,47 @@ test.group('Response', (group) => {
     assert.property(headers, 'x-powered-by')
     assert.equal(headers['x-powered-by'], 'adonisjs')
   })
+
+  test('preserve multiple Set-Cookie headers from a web-native Response', async ({ assert }) => {
+    const { url } = await httpServer.create((req, res) => {
+      const response = new HttpResponseFactory().merge({ req, res, encryption, router }).create()
+      response.send(
+        new Response('ok', {
+          headers: [
+            ['Set-Cookie', 'first=1; Path=/'],
+            ['Set-Cookie', 'second=2; Path=/'],
+          ],
+        })
+      )
+      response.finish()
+    })
+
+    const { headers } = await supertest(url).get('/').expect(200)
+    assert.deepEqual(headers['set-cookie'], ['first=1; Path=/', 'second=2; Path=/'])
+  })
+
+  test('merge Set-Cookie headers from a web-native Response with existing headers', async ({
+    assert,
+  }) => {
+    const { url } = await httpServer.create((req, res) => {
+      const response = new HttpResponseFactory().merge({ req, res, encryption, router }).create()
+      response.append('Set-Cookie', 'framework=1; Path=/')
+      response.send(
+        new Response('ok', {
+          headers: [
+            ['Set-Cookie', 'native-a=1; Path=/'],
+            ['Set-Cookie', 'native-b=2; Path=/'],
+          ],
+        })
+      )
+      response.finish()
+    })
+
+    const { headers } = await supertest(url).get('/').expect(200)
+    assert.deepEqual(headers['set-cookie'], [
+      'framework=1; Path=/',
+      'native-a=1; Path=/',
+      'native-b=2; Path=/',
+    ])
+  })
 })