{"record":{"id":"e511a85d58072027","repo":"sveltejs/kit","slug":"failed-to-get-response-header-set-cookie-it-mu","errorCode":null,"errorMessage":"Failed to get response header \"set-cookie\" — it must be included by the `filterSerializedResponseHeaders` option: https://svelte.dev/docs/kit/hooks#handle (at ${event.route.id})","messagePattern":"Failed to get response header \"set-cookie\" — it must be included by the `filterSerializedResponseHeaders` option: https://svelte\\.dev/docs/kit/hooks#handle \\(at (.+?)\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/server/page/load_data.js","lineNumber":478,"sourceCode":"\t\t\t\tif (value && !lower.startsWith('x-sveltekit-')) {\n\t\t\t\t\tconst included = resolve_opts.filterSerializedResponseHeaders(lower, value);\n\t\t\t\t\tif (!included) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`Failed to get response header \"${lower}\" — it must be included by the \\`filterSerializedResponseHeaders\\` option: https://svelte.dev/docs/kit/hooks#handle (at ${event.route.id})`\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn value;\n\t\t\t};\n\n\t\t\tconst get_set_cookie = response.headers.getSetCookie;\n\t\t\tresponse.headers.getSetCookie = () => {\n\t\t\t\tconst values = get_set_cookie.call(response.headers);\n\t\t\t\tfor (const value of values) {\n\t\t\t\t\tconst included = resolve_opts.filterSerializedResponseHeaders('set-cookie', value);\n\t\t\t\t\tif (!included) {\n\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t`Failed to get response header \"set-cookie\" — it must be included by the \\`filterSerializedResponseHeaders\\` option: https://svelte.dev/docs/kit/hooks#handle (at ${event.route.id})`\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn values;\n\t\t\t};\n\t\t}\n\n\t\treturn proxy;\n\t};\n\n\t// Don't make this function `async`! Otherwise, the user has to `catch` promises they use for streaming responses or else\n\t// it will be an unhandled rejection. Instead, we add a `.catch(noop)` ourselves below to this from happening.\n\treturn (input, init) => {\n\t\t// See docs in fetch.js for why we need to do this\n\t\tconst response = universal_fetch(input, init);\n\t\tresponse.catch(noop);","sourceCodeStart":460,"sourceCodeEnd":496,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/server/page/load_data.js#L460-L496","documentation":"During SSR, SvelteKit wraps a `fetch` response's `headers.getSetCookie` so it can serialize cookies into the page data. Before returning the values it consults the `filterSerializedResponseHeaders` option in your `handle` hook; if the callback returns false for 'set-cookie', the error is thrown instead of silently dropping cookies.","triggerScenarios":"A `load` function calls SvelteKit's `fetch` on an API whose response contains a `set-cookie` header, while the app's `handle` hook supplies a `filterSerializedResponseHeaders` callback that returns false for ('set-cookie', value), and the code then reads cookies via the wrapped getSetCookie during serialization.","commonSituations":"Apps that intentionally strip cookies from internal API responses but still have a load function that touches response cookies (e.g. reading session cookies from a backend); developers copying an example `filterSerializedResponseHeaders: (name) => name !== 'set-cookie'` without realizing serialized load data needs the header allowed.","solutions":["Update `filterSerializedResponseHeaders` in the `handle` hook to return true for 'set-cookie' when the value should be serialized","If cookies must not leak, stop reading set-cookie from that proxied fetch response and pass session info another way","Guard the header read so getSetCookie is only called when the filter allows it"],"exampleFix":"// before\nfilterSerializedResponseHeaders: (name) => name !== 'set-cookie'\n// after\nfilterSerializedResponseHeaders: (name) => name === 'set-cookie' || name === 'content-type'","handlingStrategy":"validation","validationCode":"// in handle hook\nconst filterSerializedResponseHeaders = (name, value) =>\n  name === 'set-cookie' ? shouldSerializeCookie(value) : true;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make filterSerializedResponseHeaders allow set-cookie for trusted internal APIs","Only read set-cookie from load-time fetches that you intend to serialize","Document which proxied endpoints are allowed to forward cookies"],"tags":["ssr","cookies","fetch","hooks"],"backgroundTag":"set-cookie-header-not-serialized","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}