If you curl the endpoint yourself, get any cookies? - Cloudflare Developers

© 2026 Hedgehog Software, LLC

More

Communities Docs About Terms Privacy

Walshy

W

WalshyOP•3/3/24, 2:54 AM

I'm wondering if it's a good old __cf_bm

Walshy

WWalshy If you curl the endpoint yourself, get any cookies?

chientrm.com

C

chientrm.com•3/3/24, 2:57 AM

this is when I

curl

curl

directly from terminal

Walshy

W

WalshyOP•3/3/24, 2:57 AM

No set-cookie?

Walshy

WWalshy No set-cookie?

chientrm.com

C

chientrm.com•3/3/24, 2:57 AM

absolutely not

Walshy

W

WalshyOP•3/3/24, 2:58 AM

I'm gonna say @James broke something

MattIPv4

M

MattIPv4•3/3/24, 2:58 AM

Sounds right

Walshy

W

WalshyOP•3/3/24, 2:58 AM

But seriously, not sure :thonk:

Walshy

WWalshy No set-cookie?

chientrm.com

C

chientrm.com•3/3/24, 2:58 AM

https://pastebin.com/0zXfSVPD

MattIPv4

M

MattIPv4•3/3/24, 2:59 AM

I didn't see this in the scroll back, but what does the response look like that is the issue?

MattIPv4

MMattIPv4 I didn't see this in the scroll back, but what does the response look like that ...

chientrm.com

C

chientrm.com•3/3/24, 3:01 AM

it auto add Set-CookieSet-Cookie to the end of my cache-controlcache-control response headers

chientrm.com

C

chientrm.com•3/3/24, 3:01 AM

if (isGET && isCacheable(res)) {
  if (res.headers.has('Set-Cookie')) {
    res = new Response(res.body, res);
    res.headers.append('Cache-Control', 'private=Set-Cookie');
  }
}

if (isGET && isCacheable(res)) {
  if (res.headers.has('Set-Cookie')) {
    res = new Response(res.body, res);
    res.headers.append('Cache-Control', 'private=Set-Cookie');
  }
}

Although I don't cookies.setcookies.set anywhere through my app

MattIPv4

M

MattIPv4•3/3/24, 3:02 AM

Can you share the full response headers, when they're being problematic?

MattIPv4

MMattIPv4 Can you share the full response headers, when they're being problematic?

chientrm.com

C

chientrm.com•3/3/24, 3:05 AM

So there was +server.ts+server.ts GET acts as an api endpoint

chientrm.com

C

chientrm.com•3/3/24, 3:05 AM

and another +page.server.ts+page.server.ts which

fetch

fetch

to that endpoint for data

chientrm.com

C

chientrm.com•3/3/24, 3:05 AM

here's the response headers from that

fetch

fetch

chientrm.com

C

chientrm.com•3/3/24, 3:05 AM

accept-ranges: bytes
age: 31883
cache-control: public, immutable, max-age=31536000, private=Set-Cookie
cf-cache-status: HIT
cf-ray: 85e665e1b0e66027-SIN
connection: keep-alive
content-length: 4933
content-type: application/json
date: Sun, 03 Mar 2024 03:04:14 GMT
last-modified: Sat, 02 Mar 2024 18:12:51 GMT
server: cloudflare
vary: Accept-Encoding

accept-ranges: bytes
age: 31883
cache-control: public, immutable, max-age=31536000, private=Set-Cookie
cf-cache-status: HIT
cf-ray: 85e665e1b0e66027-SIN
connection: keep-alive
content-length: 4933
content-type: application/json
date: Sun, 03 Mar 2024 03:04:14 GMT
last-modified: Sat, 02 Mar 2024 18:12:51 GMT
server: cloudflare
vary: Accept-Encoding

chientrm.com

C

chientrm.com•3/3/24, 3:06 AM

in my +server.ts+server.ts response, I do

setHeaders({ 'cache-control': 'public, immutable, max-age=31536000' });

setHeaders({ 'cache-control': 'public, immutable, max-age=31536000' });

chientrm.com

C

chientrm.com•3/3/24, 3:07 AM

it was @sveltejs/adapter-cloudflare@sveltejs/adapter-cloudflare auto append private=Set-Cookieprivate=Set-Cookie if there was another headers Set-CookieSet-Cookie

chientrm.com

C

chientrm.com•3/3/24, 3:07 AM

but I'm sure I didn't set cookie anywhere in my app

chientrm.com

C

chientrm.com•3/3/24, 3:08 AM

and if I enter +server.ts+server.ts directly from browser or

curl

curl

it, there was not Set-CookieSet-Cookie or private=Set-Cookieprivate=Set-Cookie and the cache was perfectly HITHIT

Walshy

W

WalshyOP•3/3/24, 3:08 AM

my hacky debugger brain would patch worktop and throw in a console.log

MattIPv4

M

MattIPv4•3/3/24, 3:08 AM

yeh same i'd drop a console log in to see what res.headers contains before that has check

chientrm.com

C

chientrm.com•3/3/24, 3:09 AM

I'm gonna need to fork SvelteJs/KitSvelteJs/Kit and worktopworktop to try that

Walshy

W

WalshyOP•3/3/24, 3:10 AM

nah patch-package it

Walshy

W

WalshyOP•3/3/24, 3:10 AM

(or well modify node_modules -- no need to technically generate a patch)

Walshy

WWalshy (or well modify node_modules -- no need to technically generate a patch)

chientrm.com

C

chientrm.com•3/3/24, 3:11 AM

that's gonna be npm installnpm install on Pages Build tho

actually I don't need to touch worktopworktop I guess

Walshy

W

WalshyOP•3/3/24, 3:11 AM

can you not repo locally/

Walshy

W

WalshyOP•3/3/24, 3:12 AM

if you need to run in build then yeah just patch-package it

Walshy

W

WalshyOP•3/3/24, 3:12 AM

https://www.npmjs.com/package/patch-package

MattIPv4

M

MattIPv4•3/3/24, 3:13 AM

I do think this might be cf_bm or similar

MattIPv4

M

MattIPv4•3/3/24, 3:13 AM

But I can't see why it wouldn't show up in the headers you're seeing

Walshy

WWalshy if you need to run in build then yeah just patch-package it

chientrm.com

C

chientrm.com•3/3/24, 3:16 AM

hold on I'm deploying the patched logs

MattIPv4

M

MattIPv4•3/3/24, 3:17 AM

Ohhhhh

MattIPv4

M

MattIPv4•3/3/24, 3:19 AM

new Response('test', { headers: { 'x-test': 'test', 'Set-Cookie': 'test=1' } }).headers Headers { "content-type" → "text/plain;charset=UTF-8", "x-test" → "test" }
new Response('test', { headers: { 'x-test': 'test', 'Set-Cookie': 'test=1' } }).headers Headers { "content-type" → "text/plain;charset=UTF-8", "x-test" → "test" }

MattIPv4

M

MattIPv4•3/3/24, 3:21 AM

~~I bet Workers follow the same header filtering rules as browsers, so you can't set set-cookie I think~~

MattIPv4

M

MattIPv4•3/3/24, 3:21 AM

~~And that worktop code recreates the Response~~

MattIPv4

MMattIPv4 ~~And that worktop code recreates the Response~~

chientrm.com

C

chientrm.com•3/3/24, 3:22 AM

actually it check if (isGET && isCacheable(res))if (isGET && isCacheable(res)) before recreating the Response tho

chientrm.com

C

chientrm.com•3/3/24, 3:22 AM

I patch-packagepatch-package but console.log doesn't show nothing tho

MattIPv4

M

MattIPv4•3/3/24, 3:23 AM

Yes, so the set-cookie exists on the original response, but then when the response is recreated it gets dropped

MattIPv4

M

MattIPv4•3/3/24, 3:23 AM

Is what I think is happening

Isaac McFadyen

I

Isaac McFadyen•3/3/24, 3:23 AM

You could try to log the response headers before they're recreated.

Isaac McFadyen

I

Isaac McFadyen•3/3/24, 3:23 AM

That would show you whether there was a set-cookie header that's being stripped

chientrm.com

C

chientrm.com•3/3/24, 3:25 AM

so I made this patch:

diff --git a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
index a0abb18..aa4de85 100644
--- a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
+++ b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
@@ -10,6 +10,11 @@ async function e(e3, t2) {
   return n2 && r3 && (r3 = new Response(null, r3)), r3;
 }
 function t(e3, t2, n2, o2) {
+  let tmp = '';
+    for (const [headerName, headerValue] of n2.headers.entries()) {
+        tmp += `${headerName}: ${headerValue}\n`;
+    }
+  console.log(tmp);
   return ("string" == typeof t2 || "GET" === t2.method) && r(n2) && (n2.headers.has("Set-Cookie") && (n2 = new Response(n2.body, n2)).headers.append("Cache-Control", "private=Set-Cookie"), o2.waitUntil(e3.put(t2, n2.clone()))), n2;
 }
 var n = /* @__PURE__ */ new Set([200, 203, 204, 300, 301, 404, 405, 410, 414, 501]);

diff --git a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
index a0abb18..aa4de85 100644
--- a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
+++ b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
@@ -10,6 +10,11 @@ async function e(e3, t2) {
   return n2 && r3 && (r3 = new Response(null, r3)), r3;
 }
 function t(e3, t2, n2, o2) {
+  let tmp = '';
+    for (const [headerName, headerValue] of n2.headers.entries()) {
+        tmp += `${headerName}: ${headerValue}\n`;
+    }
+  console.log(tmp);
   return ("string" == typeof t2 || "GET" === t2.method) && r(n2) && (n2.headers.has("Set-Cookie") && (n2 = new Response(n2.body, n2)).headers.append("Cache-Control", "private=Set-Cookie"), o2.waitUntil(e3.put(t2, n2.clone()))), n2;
 }
 var n = /* @__PURE__ */ new Set([200, 203, 204, 300, 301, 404, 405, 410, 414, 501]);

chientrm.com

C

chientrm.com•3/3/24, 3:27 AM

but it doesn't logs on Dashboard Real-time logs

Walshy

W

WalshyOP•3/3/24, 3:27 AM

pro tip, super easy way to log headers: console.log(Object.fromEntries(res.headers))console.log(Object.fromEntries(res.headers))

MattIPv4

M

MattIPv4•3/3/24, 3:28 AM

How does fromEntries handle duplicate keys

MattIPv4

M

MattIPv4•3/3/24, 3:29 AM

Ah last wins

MattIPv4

M

MattIPv4•3/3/24, 3:30 AM

console.log([ ...res.headers ]);console.log([ ...res.headers ]); is safer

chientrm.com

C

chientrm.com•3/3/24, 3:34 AM

uhm, I use patch-packagepatch-package but can't get adapter-cloudflareadapter-cloudflare to console.log()console.log() things

chientrm.com

C

chientrm.com•3/3/24, 3:35 AM

and the private=Set-Cookieprivate=Set-Cookie is somehow dissapeared now

diff --git a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
index a0abb18..aa4de85 100644
--- a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
+++ b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
@@ -10,6 +10,11 @@ async function e(e3, t2) {
   return n2 && r3 && (r3 = new Response(null, r3)), r3;
 }
 function t(e3, t2, n2, o2) {
+  let tmp = '';
+    for (const [headerName, headerValue] of n2.headers.entries()) {
+        tmp += `${headerName}: ${headerValue}\n`;
+    }
+  console.log(tmp);
   return ("string" == typeof t2 || "GET" === t2.method) && r(n2) && (n2.headers.has("Set-Cookie") && (n2 = new Response(n2.body, n2)).headers.append("Cache-Control", "private=Set-Cookie"), o2.waitUntil(e3.put(t2, n2.clone()))), n2;
 }
 var n = /* @__PURE__ */ new Set([200, 203, 204, 300, 301, 404, 405, 410, 414, 501]);

diff --git a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
index a0abb18..aa4de85 100644
--- a/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
+++ b/node_modules/@sveltejs/adapter-cloudflare/files/worker.js
@@ -10,6 +10,11 @@ async function e(e3, t2) {
   return n2 && r3 && (r3 = new Response(null, r3)), r3;
 }
 function t(e3, t2, n2, o2) {
+  let tmp = '';
+    for (const [headerName, headerValue] of n2.headers.entries()) {
+        tmp += `${headerName}: ${headerValue}\n`;
+    }
+  console.log(tmp);
   return ("string" == typeof t2 || "GET" === t2.method) && r(n2) && (n2.headers.has("Set-Cookie") && (n2 = new Response(n2.body, n2)).headers.append("Cache-Control", "private=Set-Cookie"), o2.waitUntil(e3.put(t2, n2.clone()))), n2;
 }
 var n = /* @__PURE__ */ new Set([200, 203, 204, 300, 301, 404, 405, 410, 414, 501]);

accept-ranges: bytes
age: 31883
cache-control: public, immutable, max-age=31536000, private=Set-Cookie
cf-cache-status: HIT
cf-ray: 85e665e1b0e66027-SIN
connection: keep-alive
content-length: 4933
content-type: application/json
date: Sun, 03 Mar 2024 03:04:14 GMT
last-modified: Sat, 02 Mar 2024 18:12:51 GMT
server: cloudflare
vary: Accept-Encoding

accept-ranges: bytes
age: 31883
cache-control: public, immutable, max-age=31536000, private=Set-Cookie
cf-cache-status: HIT
cf-ray: 85e665e1b0e66027-SIN
connection: keep-alive
content-length: 4933
content-type: application/json
date: Sun, 03 Mar 2024 03:04:14 GMT
last-modified: Sat, 02 Mar 2024 18:12:51 GMT
server: cloudflare
vary: Accept-Encoding