API Gateway v2: multiple response headers / multiple cookies

[hvipana]

Description:

I have upgraded my deployment to HttpApi (API-Gateway v2). After that I got only one cookie in response and the second cookie laravel_session was missing.

Then I switched back to RestApi (v1) and I got both cookies in response.

bref: 1.0.2
laravel: 8.4.4
runtime: provided.al2
layer.php-74-fpm

[flemzord]

I have a same bug, I came back to APIG REST for the moment

[mnapoli]

Hi,

Thanks for the report. Indeed, the API Gateway v2 format does not support multiple headers in the response. Or at least, that is what we have concluded over our research.

Here are useful links to work further on this:

• The docs on API Gateway v1 and v2 format for requests and responses
• The current Bref code that doesn't support multi-headers in responses: here and here

If you want to contribute solving this:

• test/confirm whether it is possible to return multiple headers (override false with true here): if it works, we can work on changing that in Bref
• investigate if it's possible to find another solution, for example returning all cookies into one response header?

Workarounds:

• stay on REST API which uses the v1 format

• use HTTP API (API Gateway v2) but force the v1 format:

  provider:
    httpApi:
      payload: '1.0'

[josecl]

Here are useful links to work further on this:

• The docs on API Gateway v1 and v2 format for requests and responses

According to the documentation it is possible to send a response with multiple cookies for format 2.0 through the cookies field, which will be transformed into several set-cookie headers:

Format 2.0 includes a new cookies field. All cookie headers in the request are combined with commas and added to the cookies field. In the response to the client, each cookie becomes a set-cookie header.

For example:

{
    "cookies" : ["cookie1", "cookie2"],
    "isBase64Encoded": true|false,
    "statusCode": httpStatusCode,
    "headers": { "headerName": "headerValue", ... },
    "body": "Hello from Lambda!"
} 

Hope this is useful.

[mnapoli]

Thank you @josecl that's a very very good point!

So that means that we would still not be able to support multiple response headers in general, but we could use that field to support multiple cookies.

If anyone is up for a PR go ahead. At the moment, it is not a priority for my projects nor for the Bref Enterprise customers, so it is not at the top of my TODO list. If you want to sponsor that work to get it done ASAP you can get in touch: matthieu@null.tc.