@adobe/aem-cli 16.10.46 → 16.11.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [16.11.0](https://github.com/adobe/helix-cli/compare/v16.10.47...v16.11.0) (2025-09-04)
+
+
+### Features
+
+* **up:** proxy all cookie and set-cookie headers ([b1d3eb2](https://github.com/adobe/helix-cli/commit/b1d3eb2c12c19e36fcd922a274ff487be4e07d53))
+
+## [16.10.47](https://github.com/adobe/helix-cli/compare/v16.10.46...v16.10.47) (2025-09-02)
+
+
+### Bug Fixes
+
+* **deps:** update dependency @adobe/helix-shared-indexer to v2.2.5 ([#2579](https://github.com/adobe/helix-cli/issues/2579)) ([b5fb1bc](https://github.com/adobe/helix-cli/commit/b5fb1bc482c7a8e8ca8fd5aad0e4e3ef95952354))
+
 ## [16.10.46](https://github.com/adobe/helix-cli/compare/v16.10.45...v16.10.46) (2025-08-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.10.46",
+  "version": "16.11.0",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",
@@ -43,7 +43,7 @@
     "@adobe/helix-log": "7.0.0",
     "@adobe/helix-shared-config": "11.1.9",
     "@adobe/helix-shared-git": "3.0.20",
-    "@adobe/helix-shared-indexer": "2.2.4",
+    "@adobe/helix-shared-indexer": "2.2.5",
     "camelcase": "8.0.0",
     "chalk-template": "1.1.0",
     "chokidar": "4.0.3",

package/src/server/HelixProject.js

@@ -68,6 +68,11 @@ export class HelixProject extends BaseProject {
     return this;
   }
 
+  withCookies(value) {
+    this._server.withCookies(value);
+    return this;
+  }
+
   get proxyUrl() {
     return this._proxyUrl;
   }

package/src/server/HelixServer.js

@@ -34,6 +34,7 @@ export class HelixServer extends BaseServer {
     this._enableLiveReload = false;
     this._app.use(compression());
     this._autoLogin = true;
+    this._cookies = false;
   }
 
   withLiveReload(value) {
@@ -46,6 +47,11 @@ export class HelixServer extends BaseServer {
     return this;
   }
 
+  withCookies(value) {
+    this._cookies = value;
+    return this;
+  }
+
   async handleLogin(req, res) {
     // disable autologin if login was called at least once
     this._autoLogin = false;
@@ -205,6 +211,7 @@ export class HelixServer extends BaseServer {
         siteToken: this._siteToken,
         loginPath: LOGIN_ROUTE,
         autoLogin: this._autoLogin,
+        cookies: this._cookies,
       });
     } catch (err) {
       log.error(`${pfx}failed to proxy AEM request ${ctx.path}: ${err.message}`);

package/src/server/utils.js

@@ -254,14 +254,16 @@ window.LiveReloadOptions = {
       headers.authorization = `token ${opts.siteToken}`;
     }
 
-    // preserve hlx-auth-token cookie
-    const cookies = cookie.parse(headers.cookie || '');
-    delete headers.cookie;
-    const hlxAuthToken = cookies['hlx-auth-token'];
-    if (hlxAuthToken) {
-      headers.cookie = new URLSearchParams({
-        'hlx-auth-token': hlxAuthToken,
-      }).toString();
+    if (!opts.cookies) {
+      // only pass through hlx-auth-token cookie
+      const cookies = cookie.parse(headers.cookie || '');
+      delete headers.cookie;
+      const hlxAuthToken = cookies['hlx-auth-token'];
+      if (hlxAuthToken) {
+        headers.cookie = new URLSearchParams({
+          'hlx-auth-token': hlxAuthToken,
+        }).toString();
+      }
     }
 
     delete headers.connection;
@@ -278,8 +280,13 @@ window.LiveReloadOptions = {
     const level = utils.status2level(ret.status, true);
     ctx.log[level](`[${id}] Proxy ${req.method} request to ${url}: ${ret.status} (${contentType})`);
 
-    // because fetch decodes the response, we need to reset content encoding and length
     const respHeaders = Object.fromEntries(ret.headers.entries());
+    // multiple Set-Cookie headers need special handling
+    // https://www.npmjs.com/package/node-fetch#extract-set-cookie-header
+    const setCookieValues = ret.headers.raw()['set-cookie'];
+    if (setCookieValues?.length) {
+      respHeaders['set-cookie'] = setCookieValues;
+    }
     delete respHeaders['content-encoding'];
     delete respHeaders['content-length'];
     delete respHeaders['x-frame-options'];

package/src/up.cmd.js

@@ -44,6 +44,11 @@ export default class UpCommand extends AbstractServerCommand {
     return this;
   }
 
+  withCookies(value) {
+    this._cookies = value;
+    return this;
+  }
+
   async doStop() {
     await super.doStop();
     if (this._watcher) {
@@ -76,7 +81,8 @@ export default class UpCommand extends AbstractServerCommand {
       .withKill(this._kill)
       .withPrintIndex(this._printIndex)
       .withAllowInsecure(this._allowInsecure)
-      .withSiteToken(this._siteToken);
+      .withSiteToken(this._siteToken)
+      .withCookies(this._cookies);
 
     this.log.info(chalk`{yellow     ___    ________  ___                          __      __ v${pkgJson.version}}`);
     this.log.info(chalk`{yellow    /   |  / ____/  |/  /  _____(_)___ ___  __  __/ /___ _/ /_____  _____}`);

package/src/up.js

@@ -104,6 +104,11 @@ export default function up() {
           type: 'boolean',
           default: false,
         })
+        .option('cookies', {
+          describe: 'Proxy all cookies in requests. By default, only the hlx-auth-token cookie is proxied.',
+          type: 'boolean',
+          default: false,
+        })
 
         .help();
     },
@@ -128,6 +133,7 @@ export default function up() {
         .withAllowInsecure(argv.allowInsecure)
         .withKill(argv.stopOther)
         .withCache(argv.alphaCache)
+        .withCookies(argv.cookies)
         .run();
     },
   };