starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #1546] Cookie missing in response #492

New issue

Closed

opened 2026-03-16 15:39:08 +03:00 by kerem · 10 comments

kerem commented

2026-03-16 15:39:08 +03:00

Owner

Originally created by @A-Chainsmokers on GitHub (Mar 18, 2021).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/1546

Originally assigned to: @CuriousCorrelation on GitHub.

The response has three set-cookies,But it only gets one(Please forgive me for my poor English)

Originally created by @A-Chainsmokers on GitHub (Mar 18, 2021). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/1546 Originally assigned to: @CuriousCorrelation on GitHub. The response has three set-cookies,But it only gets one(Please forgive me for my poor English) ![20210318101539](https://user-images.githubusercontent.com/35914432/111563611-3b705980-87d3-11eb-8399-d819354565d9.png) ![20210318101633](https://user-images.githubusercontent.com/35914432/111563614-3d3a1d00-87d3-11eb-9ce7-c2e95548385a.png)

kerem

2026-03-16 15:39:08 +03:00

closed this issue
added the
desktop
label

kerem commented

2026-03-16 15:39:24 +03:00

Author

Owner

@liyasthomas commented on GitHub (Mar 18, 2021):

Thanks for reporting the issue. This shouldn't happen in normal scenarios. We're investigating if there's any internal blockers on displaying multiple headers with same keys. Please be patient.

@liyasthomas commented on GitHub (Mar 18, 2021): Thanks for reporting the issue. This shouldn't happen in normal scenarios. We're investigating if there's any internal blockers on displaying multiple headers with same keys. Please be patient.

kerem commented

2026-03-16 15:39:29 +03:00

Author

Owner

@A-Chainsmokers commented on GitHub (Mar 18, 2021):

@liyasthomas The same key will reset the value,You can try to make him present in the form of an array

@A-Chainsmokers commented on GitHub (Mar 18, 2021): @liyasthomas The same key will reset the value,You can try to make him present in the form of an array

kerem commented

2026-03-16 15:39:34 +03:00

Author

Owner

@Townsheriff commented on GitHub (Jan 26, 2022):

Hey,

I'm wondering why this is closed with no explanation? I'm having same issue. If the logs and test case are missing I can sure provide it.

In my case I have one "Set-Cookie" in the curl and nothing in the headers response in the hoppscotch.

Set-Cookie: session=uEvbF5N5z4g60gcvadGcgYWcOnCdOm4Ku66dCxEV; expires=Wed, 26-Jan-2022 14:59:22 GMT; Max-Age=7200; path=/; httponly; samesite=lax

Maybe this is somewhat related with httponly. httponly is a cookie that is not accessible through javascript and is automatically attached to requests for specific domain.

MDN docs - here.

Cheers,
Arturs

@Townsheriff commented on GitHub (Jan 26, 2022): Hey, I'm wondering why this is closed with no explanation? I'm having same issue. If the logs and test case are missing I can sure provide it. In my case I have one "Set-Cookie" in the curl and nothing in the headers response in the hoppscotch. ``` Set-Cookie: session=uEvbF5N5z4g60gcvadGcgYWcOnCdOm4Ku66dCxEV; expires=Wed, 26-Jan-2022 14:59:22 GMT; Max-Age=7200; path=/; httponly; samesite=lax ``` Maybe this is somewhat related with httponly. httponly is a cookie that is not accessible through javascript and is automatically attached to requests for specific domain. MDN docs - [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies). Cheers, Arturs

kerem commented

2026-03-16 15:39:39 +03:00

Author

Owner

@yrachid commented on GitHub (Dec 19, 2023):

I was recently testing a similar scenario and just wanted to add that this issue is not specific to cookies, any duplicate header will be overwritten:

Although unusual, this is technically a correct use of HTTP Headers, as long as the values can be combined into a comma-separated list. The only exception is for Set-Cookie, which violates HTTP specs: https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.2

@yrachid commented on GitHub (Dec 19, 2023): I was recently testing a similar scenario and just wanted to add that this issue is not specific to cookies, any duplicate header will be overwritten: ![Screenshot_20231219_223856](https://github.com/hoppscotch/hoppscotch/assets/4705127/ab1b8ca5-15eb-40e8-9e73-c5dfd148e891) Although unusual, this is technically a correct use of HTTP Headers, as long as the values can be combined into a comma-separated list. The only exception is for Set-Cookie, which violates HTTP specs: https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.2

kerem commented

2026-03-16 15:39:44 +03:00

Author

Owner

@satyadeepk commented on GitHub (May 8, 2024):

According to this doc, multiple set-cookie headers are valid. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie,

To send multiple cookies, multiple Set-Cookie headers should be sent in the same response.

Can you please re-open the issue

@satyadeepk commented on GitHub (May 8, 2024): According to this doc, multiple set-cookie headers are valid. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie, > To send multiple cookies, multiple Set-Cookie headers should be sent in the same response. Can you please re-open the issue

kerem commented

2026-03-16 15:39:49 +03:00

Author

Owner

@MexHigh commented on GitHub (May 26, 2024):

Can you please re-open the issue

Yes please @liyasthomas, this does not work for me, too.

I've built a small python Flask app to test multiple Set-Cookie headers:

from flask import Flask, make_response

app = Flask(__name__)

@app.route('/')
def set_cookies():
    response = make_response('Cookies set')
    response.set_cookie('cookie1', 'value1')
    response.set_cookie('cookie2', 'value2')
    response.headers['x-header-test'] = 'success'
    return response

if __name__ == '__main__':
    app.run(debug=True)

Hoppscotch Desktop (24.3.2) only shows the last Set-Cookie header (cookie2) and the x-header-test header.

@MexHigh commented on GitHub (May 26, 2024): > Can you please re-open the issue Yes please @liyasthomas, this does not work for me, too. I've built a small python Flask app to test multiple `Set-Cookie` headers: ```py from flask import Flask, make_response app = Flask(__name__) @app.route('/') def set_cookies(): response = make_response('Cookies set') response.set_cookie('cookie1', 'value1') response.set_cookie('cookie2', 'value2') response.headers['x-header-test'] = 'success' return response if __name__ == '__main__': app.run(debug=True) ``` Hoppscotch Desktop (24.3.2) only shows the last `Set-Cookie` header (cookie2) and the `x-header-test` header.

kerem commented

2026-03-16 15:39:54 +03:00

Author

Owner

@timemrah commented on GitHub (Apr 6, 2025):

When I set two separate cookies in a request, I only see one.

Headers sent by backend:

Array
(
    [0] => X-Powered-By: PHP/8.4.5
    [1] => Set-Cookie: Device-Token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzU0ODcxMjQsImp0aSI6IjAxOTYwYjk2LTU5ZDUtN2NiOC00YzMxLTViNzIwYzI1ODY5MCJ9.sp0BFyiiRj6pUA3Rj4KHGQIOWsw90Nrdrxg9A27gKq8; expires=Mon, 06 Apr 2026 14:52:04 GMT; Max-Age=31536000; path=/; domain=sizeait.com; secure; HttpOnly; SameSite=Strict
    [2] => Content-Type: application/json; charset=utf-8
    [3] => Access-Control-Allow-Origin: *
    [4] => Set-Cookie: Restaurant-Authorization=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIwMTk2MGI5Ni01OWQ4LTc0NzAtNjI3ZC0yMTdlYTg4MTBhN2UiLCJzdWIiOiJjYTNhZjMwYS0xMWRmLTExZjAtOWJkZS1mY2M0ZTAxNWM3YTgiLCJhdWQiOiJzaXplYWl0LmNvbSIsImV4cCI6MTc0Mzk5NDMyNH0.4KXAIyUST5tbfThur3f2KtlPC4CcvhDt1wmLUM_pWGA; expires=Mon, 07 Apr 2025 02:52:04 GMT; Max-Age=43200; path=/; domain=sizeait.com; secure; HttpOnly; SameSite=Strict
)

Headers displayed by Hoppscotch

(
    [0] => X-Powered-By: PHP/8.4.5
    [1] => Set-Cookie: Device-Token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzU0ODcxMjQsImp0aSI6IjAxOTYwYjk2LTU5ZDUtN2NiOC00YzMxLTViNzIwYzI1ODY5MCJ9.sp0BFyiiRj6pUA3Rj4KHGQIOWsw90Nrdrxg9A27gKq8; expires=Mon, 06 Apr 2026 14:52:04 GMT; Max-Age=31536000; path=/; domain=sizeait.com; secure; HttpOnly; SameSite=Strict
    [2] => Content-Type: application/json; charset=utf-8
    [3] => Access-Control-Allow-Origin: *
)

@timemrah commented on GitHub (Apr 6, 2025): When I set two separate cookies in a request, I only see one. **Headers sent by backend:** ``` Array ( [0] => X-Powered-By: PHP/8.4.5 [1] => Set-Cookie: Device-Token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzU0ODcxMjQsImp0aSI6IjAxOTYwYjk2LTU5ZDUtN2NiOC00YzMxLTViNzIwYzI1ODY5MCJ9.sp0BFyiiRj6pUA3Rj4KHGQIOWsw90Nrdrxg9A27gKq8; expires=Mon, 06 Apr 2026 14:52:04 GMT; Max-Age=31536000; path=/; domain=sizeait.com; secure; HttpOnly; SameSite=Strict [2] => Content-Type: application/json; charset=utf-8 [3] => Access-Control-Allow-Origin: * [4] => Set-Cookie: Restaurant-Authorization=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiIwMTk2MGI5Ni01OWQ4LTc0NzAtNjI3ZC0yMTdlYTg4MTBhN2UiLCJzdWIiOiJjYTNhZjMwYS0xMWRmLTExZjAtOWJkZS1mY2M0ZTAxNWM3YTgiLCJhdWQiOiJzaXplYWl0LmNvbSIsImV4cCI6MTc0Mzk5NDMyNH0.4KXAIyUST5tbfThur3f2KtlPC4CcvhDt1wmLUM_pWGA; expires=Mon, 07 Apr 2025 02:52:04 GMT; Max-Age=43200; path=/; domain=sizeait.com; secure; HttpOnly; SameSite=Strict ) ``` **Headers displayed by Hoppscotch** ``` ( [0] => X-Powered-By: PHP/8.4.5 [1] => Set-Cookie: Device-Token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzU0ODcxMjQsImp0aSI6IjAxOTYwYjk2LTU5ZDUtN2NiOC00YzMxLTViNzIwYzI1ODY5MCJ9.sp0BFyiiRj6pUA3Rj4KHGQIOWsw90Nrdrxg9A27gKq8; expires=Mon, 06 Apr 2026 14:52:04 GMT; Max-Age=31536000; path=/; domain=sizeait.com; secure; HttpOnly; SameSite=Strict [2] => Content-Type: application/json; charset=utf-8 [3] => Access-Control-Allow-Origin: * ) ```

kerem commented

2026-03-16 15:39:59 +03:00

Author

Owner

@Wdestroier commented on GitHub (Jul 26, 2025):

I'm having the same issue. Only a single header key/name is kept.

Hoppscotch:

Postman:

@Wdestroier commented on GitHub (Jul 26, 2025): I'm having the same issue. Only a single header key/name is kept. Hoppscotch: <img width="1299" height="211" alt="Image" src="https://github.com/user-attachments/assets/9b224dc2-52af-4d0c-9c67-ecbd8afdd456" /> Postman: <img width="1395" height="304" alt="Image" src="https://github.com/user-attachments/assets/b10aaf22-308e-40a2-9f44-cb1a69185974" />

kerem commented

2026-03-16 15:40:05 +03:00

Author

Owner

@supriyahegde commented on GitHub (Jul 28, 2025):

Hi Team, Im also facing this issue in v2025.6.1 desktop app.
Could you please help us to get this fixed.
@jamesgeorge007 @liyasthomas

@supriyahegde commented on GitHub (Jul 28, 2025): Hi Team, Im also facing this issue in v2025.6.1 desktop app. Could you please help us to get this fixed. @jamesgeorge007 @liyasthomas

kerem commented

2026-03-16 15:40:10 +03:00

Author

Owner

@liyasthomas commented on GitHub (Sep 29, 2025):

The latest version of Hoppscotch has resolved this bug.

@liyasthomas commented on GitHub (Sep 29, 2025): The latest version of Hoppscotch has resolved this bug.

kerem referenced this issue

2026-03-17 00:20:18 +03:00

[PR #492] [MERGED] i18n Japanese: Added new translations #2653