{"record":{"id":"2c6709404f9c96a5","repo":"sveltejs/kit","slug":"use-event-cookies-set-name-value-options-inst","errorCode":null,"errorMessage":"Use `event.cookies.set(name, value, options)` instead of `event.setHeaders` to set cookies","messagePattern":"Use `event\\.cookies\\.set\\(name, value, options\\)` instead of `event\\.setHeaders` to set cookies","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/server/respond.js","lineNumber":217,"sourceCode":"\t\tplatform: state.emulator?.platform\n\t\t\t? await state.emulator.platform({\n\t\t\t\t\tconfig: {},\n\t\t\t\t\tprerender: !!state.prerendering?.fallback\n\t\t\t\t})\n\t\t\t: state.platform,\n\t\trequest,\n\t\troute: { id: null },\n\t\tsetHeaders: (new_headers) => {\n\t\t\tif (DEV) {\n\t\t\t\tvalidateHeaders(new_headers);\n\t\t\t}\n\n\t\t\tfor (const key in new_headers) {\n\t\t\t\tconst lower = key.toLowerCase();\n\t\t\t\tconst value = new_headers[key];\n\n\t\t\t\tif (lower === 'set-cookie') {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t'Use `event.cookies.set(name, value, options)` instead of `event.setHeaders` to set cookies'\n\t\t\t\t\t);\n\t\t\t\t} else if (lower in headers) {\n\t\t\t\t\t// appendHeaders-style for Server-Timing https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing\n\t\t\t\t\tif (lower === 'server-timing') {\n\t\t\t\t\t\theaders[lower] += ', ' + value;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new Error(`\"${key}\" header is already set`);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\theaders[lower] = value;\n\n\t\t\t\t\tif (state.prerendering && lower === 'cache-control') {\n\t\t\t\t\t\tstate.prerendering.cache = /** @type {string} */ (value);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t},","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/server/respond.js#L199-L235","documentation":"`event.setHeaders` manipulates the response's plain headers object, but cookies must go through the cookie jar so they merge with SvelteKit-managed cookies (auth, CSRF, etc.). Setting `set-cookie` via setHeaders would overwrite or conflict with the jar, so it throws immediately.","triggerScenarios":"In a `handle` hook, `load`, or action, code calls `event.setHeaders({ 'set-cookie': '...' })` (any key casing), triggering the `lower === 'set-cookie'` branch in internal_respond's header application.","commonSituations":"Porting Express middleware that sets cookies via headers; copying code that sets session cookies with setHeaders; framework migration where the cookies API was introduced after the code was written.","solutions":["Replace `event.setHeaders({ 'set-cookie': ... })` with `event.cookies.set(name, value, options)`","For multiple cookies, call event.cookies.set once per cookie","For deleting cookies, use event.cookies.delete(name, options)"],"exampleFix":"// before\nevent.setHeaders({ 'set-cookie': 'session=abc; Path=/; HttpOnly' });\n// after\nevent.cookies.set('session', 'abc', { path: '/', httpOnly: true });","handlingStrategy":"validation","validationCode":"function assertNoSetCookie(headers) {\n  if (Object.keys(headers).some((k) => k.toLowerCase() === 'set-cookie')) {\n    throw new Error('use event.cookies.set for cookies');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use event.cookies.set/delete for cookie mutations","Reserve event.setHeaders for non-cookie response headers","Audit ported middleware for header-based cookie setting"],"tags":["cookies","setheaders","hooks"],"backgroundTag":"set-cookie-via-setheaders","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}