-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
False
-
-
False
-
---
-
-
Multiple Set-Cookie headers were merged into a single header when running Quarkus as an AWS Lambda behind API Gateway v2. The cause was a case-sensitive check for "set-cookie" in LambdaHttpHandler, while Vert.x HeadersMultiMap normalizes names (e.g., "Set-Cookie") and is case-insensitive. As a result, cookie values were treated as regular headers and comma-joined, breaking multiple-cookie scenarios.
Change the comparison to equalsIgnoreCase and route Set-Cookie values to the API Gateway v2 cookies array, preserving each cookie as a separate entry and omitting headers.'Set-Cookie' in the Lambda response.
Also add tests and a small resource to verify behavior:
CookiesResource to emit one or two cookies via JAX-RS.
AmazonLambdaSimpleTestCase:
testSingleCookieByEvent and testMultipleCookiesByEvent assert cookies[] is populated and headers.'Set-Cookie' is absent for API Gateway v2 events.
testMultipleCookiesDirectHttp asserts direct HTTP responses still return multiple Set-Cookie headers.
References:
API Gateway v2 Lambda payload: https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html
Fixes: #50075