Wrong parsing: parser can't split cookies

[Hiron Tez]

Input string:

refreshToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiI2NWEwZWM1MmYzOTE4YTlhMTE2MjBmMDUiLCJpYXQiOjE3MDUwNDUwNzUsImV4cCI6MTcxMDIyOTA3NX0.YbyImGmGSRI6Lz5aXXA0keaMaFJiQFz1qo_IILRZxqY; Path=/; Expires=Tue, 12 Mar 2024 07:37:55 GMT; HttpOnly, accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2NThhZTFiNWMzYzFhYWZmODJlZjk5ZjAiLCJpYXQiOjE3MDUwNDUwNzUsImV4cCI6MTcwNTA0NTY3NX0.uQqUEN6LxDDHHqcYp24qh8rFn-1LDVH88wGVw3Gzu48; Path=/; Expires=Fri, 12 Jan 2024 07:47:55 GMT; HttpOnly

Output:

{
  key: 'refreshToken',
  value: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiI2NWEwZjBiMTNmMzlmYWY4MTM1YWU3NmQiLCJpYXQiOjE3MDUwNDYxOTMsImV4cCI6MTcxMDIzMDE5M30.3ox9pC7jO9hAW9Y-yI3WhQ6-HBbBOxfEtEeTa6cj9eg',
  expires: 2024-01-12T08:06:33.000Z,
  maxAge: null,
  domain: null,
  path: '/',
  secure: false,
  httpOnly: true,
  extensions: [
  'HttpOnly, accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI2NThhZTFiNWMzYzFhYWZmODJlZjk5ZjAiLCJpYXQiOjE3MDUwNDYxOTMsImV4cCI6MTcwNTA0Njc5M30.iVAwOoHuf7UTJap8p2xO9prGb-p71xFNwFUfBg4xCJo'
],
  hostOnly: null,
  pathIsDefault: null,
  creation: 2024-01-12T07:56:33.979Z,
  lastAccessed: null,
  sameSite: undefined,
  [Symbol(nodejs.util.inspect.custom)]: [Function: inspect]
}

[Colin Casey]

@HironTez See RFC6265:

Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. The usual mechanism for folding HTTP headers fields (i.e., as defined in [RFC2616]) might change the semantics of the Set-Cookie header field because the %x2C (",") character is used by Set-Cookie in a way that conflicts with such folding.

The input string you've given has two cookies folded into one which is not valid.

I'm closing this issue but feel free to reopen and add additional context if I've misunderstood.

[Hiron Tez]

@colincasey Thanks for the reply. I think you're right. It seems like it's a problem with the headers.get() method because it returns merged fields. But still it seems possible to split them even from a string. splitCookiesString function from set-cookie-parser does it