fastify 6.0.0-alpha.3 → 6.0.0-alpha.5

package/lib/request.js

@@ -122,8 +122,10 @@ function buildRequestWithTrustProxy (R, trustProxy) {
     host: {
       get () {
         const socket = this.raw.socket
-        if (this.headers['x-forwarded-host'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
-          return getLastEntryInMultiHeaderValue(this.headers['x-forwarded-host'])
+        // The headers getter may allocate a new object, so read it once.
+        const headers = this.headers
+        if (headers['x-forwarded-host'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
+          return getLastEntryInMultiHeaderValue(headers['x-forwarded-host'])
         }
         /**
          * The last fallback supports the following cases:
@@ -131,14 +133,16 @@ function buildRequestWithTrustProxy (R, trustProxy) {
          * 2. HTTP/1.0 without a Host Header
          * 3. Headers schema that may remove the Host Header
          */
-        return this.headers.host ?? this.headers[':authority'] ?? ''
+        return headers.host ?? headers[':authority'] ?? ''
       }
     },
     protocol: {
       get () {
         const socket = this.raw.socket
-        if (this.headers['x-forwarded-proto'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
-          return getLastEntryInMultiHeaderValue(this.headers['x-forwarded-proto'])
+        // The headers getter may allocate a new object, so read it once.
+        const headers = this.headers
+        if (headers['x-forwarded-proto'] && socket != null && proxyFn(socket.remoteAddress, 0)) {
+          return getLastEntryInMultiHeaderValue(headers['x-forwarded-proto'])
         }
         if (this.socket) {
           return this.socket.encrypted ? 'https' : 'http'

package/lib/route.js

@@ -466,8 +466,12 @@ function buildRouting (options) {
       // the child logger creation altogether
       childLogger = logger
     } else {
-      const loggerOpts = {
-        level: context.logLevel
+      const loggerOpts = {}
+
+      // An empty level means "inherit". Passing it would make pino treat it
+      // as a level change and rebuild every log method of each request child.
+      if (context.logLevel) {
+        loggerOpts.level = context.logLevel
       }
 
       if (context.logSerializers) {

package/lib/validation.js

@@ -13,7 +13,7 @@ const {
   FST_ERR_SCH_RESPONSE_SCHEMA_NOT_NESTED_2XX
 } = require('./errors')
 
-const { FSTWRN001, FSTSEC002 } = require('./warnings')
+const { FSTWRN001, FSTSEC002, FSTSEC003 } = require('./warnings')
 
 function compileSchemasForSerialization (context, compile) {
   if (!context.schema || !context.schema.response) {
@@ -70,9 +70,14 @@ function compileSchemasForSerialization (context, compile) {
 // reachable through `allOf`, `anyOf`, `oneOf`, `not`, `if`/`then`/`else`, local
 // `$ref` definitions (`definitions`/`$defs`), and the other standard subschema
 // containers. The input schema is never mutated: a new schema tree is returned.
-function lowerCaseHeadersSchema (schema) {
+//
+// A `propertyNames` subschema validates each header name itself, so values held
+// in `enum` and `const` (and in every subschema reachable from it) are header
+// names rather than header values. `insidePropertyNames` tracks that context so
+// those `enum`/`const` string values are lowercased there, and only there.
+function lowerCaseHeadersSchema (schema, insidePropertyNames = false) {
   if (Array.isArray(schema)) {
-    return schema.map(lowerCaseHeadersSchema)
+    return schema.map(item => lowerCaseHeadersSchema(item, insidePropertyNames))
   }
   if (schema === null || typeof schema !== 'object') {
     return schema
@@ -91,7 +96,7 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const prop of Object.keys(value)) {
-          normalized[prop.toLowerCase()] = lowerCaseHeadersSchema(value[prop])
+          normalized[prop.toLowerCase()] = lowerCaseHeadersSchema(value[prop], insidePropertyNames)
         }
         result.properties = normalized
         break
@@ -112,7 +117,7 @@ function lowerCaseHeadersSchema (schema) {
           if (Array.isArray(depValue)) {
             normalized[dep.toLowerCase()] = depValue.map(name => name.toLowerCase())
           } else {
-            normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(depValue)
+            normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(depValue, insidePropertyNames)
           }
         }
         result.dependencies = normalized
@@ -125,7 +130,7 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const dep of Object.keys(value)) {
-          normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(value[dep])
+          normalized[dep.toLowerCase()] = lowerCaseHeadersSchema(value[dep], insidePropertyNames)
         }
         result.dependentSchemas = normalized
         break
@@ -158,12 +163,21 @@ function lowerCaseHeadersSchema (schema) {
       case 'unevaluatedItems':
       case 'unevaluatedProperties':
       case 'contains':
-      case 'propertyNames':
       case 'contentSchema':
-        result[key] = lowerCaseHeadersSchema(value)
+        result[key] = lowerCaseHeadersSchema(value, insidePropertyNames)
+        break
+      case 'propertyNames':
+        result[key] = lowerCaseHeadersSchema(value, true)
         break
       // Maps of subschemas whose keys are not header names (definition names,
       // regex patterns): keep the keys, normalize the subschema values.
+      //
+      // `patternProperties` keys are regular expressions matched against the
+      // already-lowercased header names and are left as-is: a regular expression
+      // cannot be safely lowercased. The same applies to a `propertyNames`
+      // `pattern`. A header-name pattern written in canonical case will not match
+      // the lowercased request headers, so it must be authored to match
+      // lowercase. See docs/Reference/Validation-and-Serialization.md.
       case 'definitions':
       case '$defs':
       case 'patternProperties': {
@@ -173,13 +187,23 @@ function lowerCaseHeadersSchema (schema) {
         }
         const normalized = {}
         for (const k of Object.keys(value)) {
-          normalized[k] = lowerCaseHeadersSchema(value[k])
+          normalized[k] = lowerCaseHeadersSchema(value[k], insidePropertyNames)
         }
         result[key] = normalized
         break
       }
       default:
-        result[key] = value
+        // Inside a `propertyNames` subschema, `enum` and `const` values are the
+        // candidate header names themselves, so they must be lowercased to match
+        // the lowercased request headers. Everywhere else these hold header
+        // *values* (or arbitrary constant data) and must be left untouched.
+        if (insidePropertyNames && key === 'enum' && Array.isArray(value)) {
+          result[key] = value.map(item => typeof item === 'string' ? item.toLowerCase() : item)
+        } else if (insidePropertyNames && key === 'const' && typeof value === 'string') {
+          result[key] = value.toLowerCase()
+        } else {
+          result[key] = value
+        }
     }
   }
 
@@ -217,6 +241,35 @@ function findExternalHeaderRef (schema) {
   return undefined
 }
 
+// A `$ref` reached inside a `propertyNames` subschema resolves to a definition
+// that is normalized in its own, non-`propertyNames` context, so header names
+// held in its `enum`/`const` keep their original case and a case-insensitive
+// deny-list or allow-list never matches the lowercased request headers. We
+// cannot safely normalize the referenced definition here because it may be
+// shared with value contexts, so we detect the reference and warn instead.
+// Returns the first local `$ref` found inside a `propertyNames` subschema, or
+// undefined.
+function findPropertyNamesRef (schema, insidePropertyNames = false) {
+  if (Array.isArray(schema)) {
+    for (const item of schema) {
+      const ref = findPropertyNamesRef(item, insidePropertyNames)
+      if (ref !== undefined) return ref
+    }
+    return undefined
+  }
+  if (schema === null || typeof schema !== 'object') {
+    return undefined
+  }
+  if (insidePropertyNames && typeof schema.$ref === 'string' && schema.$ref[0] === '#') {
+    return schema.$ref
+  }
+  for (const key of Object.keys(schema)) {
+    const ref = findPropertyNamesRef(schema[key], insidePropertyNames || key === 'propertyNames')
+    if (ref !== undefined) return ref
+  }
+  return undefined
+}
+
 function compileSchemasForValidation (context, compile, isCustom) {
   const { schema } = context
   if (!schema) {
@@ -246,6 +299,10 @@ function compileSchemasForValidation (context, compile, isCustom) {
       if (externalRef !== undefined) {
         FSTSEC002(method, url, externalRef)
       }
+      const propertyNamesRef = findPropertyNamesRef(headers)
+      if (propertyNamesRef !== undefined) {
+        FSTSEC003(method, url, propertyNamesRef)
+      }
       context[headersSchema] = compile({ schema: headersSchemaLowerCase, method, url, httpPart: 'headers' })
     }
   } else if (Object.hasOwn(schema, 'headers')) {
@@ -284,19 +341,21 @@ function compileSchemasForValidation (context, compile, isCustom) {
 }
 
 function validateParam (validatorFunction, request, paramName) {
-  const isUndefined = request[paramName] === undefined
+  // The headers getter may allocate a new object, so only read it when needed.
+  if (validatorFunction == null) return false
+  const value = request[paramName]
   let ret
 
   try {
-    const data = isUndefined ? null : request[paramName]
+    const data = value === undefined ? null : value
     // Ajv can only mutate a root value when its parent is provided.
-    if (validatorFunction?.schemaEnv) {
+    if (validatorFunction.schemaEnv) {
       ret = validatorFunction(data, {
         parentData: request,
         parentDataProperty: paramName
       })
     } else {
-      ret = validatorFunction?.(data)
+      ret = validatorFunction(data)
     }
   } catch (err) {
     // If validator throws synchronously, ensure it propagates as an internal error

package/lib/warnings.js

@@ -7,6 +7,7 @@ const { createWarning } = require('process-warning')
  *   - FSTWRN001
  *   - FSTSEC001
  *   - FSTSEC002
+ *   - FSTSEC003
  *
  * Deprecation Codes FSTDEP001 - FSTDEP021 were used by v4 and MUST NOT be reused.
  *                             - FSTDEP022 - FSTDEP025 are used by v5 and MUST NOT be reused.
@@ -41,9 +42,17 @@ const FSTSEC002 = createWarning({
   unlimited: true
 })
 
+const FSTSEC003 = createWarning({
+  name: 'FastifySecurity',
+  code: 'FSTSEC003',
+  message: 'The headers schema for %s: %s uses a $ref (%s) inside propertyNames that is not case-normalized. Header names held in the referenced schema keep their original case and will not match the lowercased request headers, so a case-insensitive deny-list or allow-list on header names may not apply. Inline the propertyNames constraint instead of referencing it with a $ref.',
+  unlimited: true
+})
+
 module.exports = {
   FSTWRN001,
   FSTWRN003,
   FSTSEC001,
-  FSTSEC002
+  FSTSEC002,
+  FSTSEC003
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "6.0.0-alpha.3",
+  "version": "6.0.0-alpha.5",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",

package/test/child-logger-factory.test.js

@@ -126,3 +126,28 @@ test('should throw error if invalid logger is returned', (t, done) => {
     }, { code: 'FST_ERR_LOG_INVALID_LOGGER' })
   })
 })
+
+test('request child loggers only receive a level when the route sets one', async t => {
+  t.plan(3)
+
+  const fastify = Fastify({ logger: { level: 'info', stream: { write () {} } } })
+  const levels = []
+  fastify.setChildLoggerFactory(function (logger, bindings, opts) {
+    // an empty level would make pino reset the level of every request child
+    levels.push(Object.hasOwn(opts, 'level') ? opts.level : 'inherited')
+    return logger.child(bindings, opts)
+  })
+
+  fastify.get('/', (req, reply) => {
+    reply.send(req.log.level)
+  })
+  fastify.get('/warn', { logLevel: 'warn' }, (req, reply) => {
+    reply.send(req.log.level)
+  })
+
+  t.after(() => fastify.close())
+
+  t.assert.strictEqual((await fastify.inject('/')).body, 'info')
+  t.assert.strictEqual((await fastify.inject('/warn')).body, 'warn')
+  t.assert.deepStrictEqual(levels, ['inherited', 'warn'])
+})

package/test/content-parser.test.js

@@ -2,6 +2,7 @@
 
 const { test } = require('node:test')
 const { spyWarning } = require('process-warning')
+const { Readable } = require('node:stream')
 const Fastify = require('..')
 const keys = require('../lib/symbols')
 const { FST_ERR_CTP_ALREADY_PRESENT, FST_ERR_CTP_INVALID_TYPE, FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('../lib/errors')
@@ -767,3 +768,62 @@ test('content-type fail when not a valid type', async t => {
     t.assert.equal(error.message, 'The content type should be a string or a RegExp')
   }
 })
+
+test('string body keeps multi-byte characters split across chunks', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  const encoded = Buffer.from(JSON.stringify({ hello: 'wörld ✓ 😀' }))
+
+  fastify.addHook('preParsing', async () => {
+    // Emit one byte per chunk so every multi-byte character is split
+    return Readable.from(Array.from(encoded, byte => Buffer.from([byte])), { objectMode: false })
+  })
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    payload: encoded
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.deepStrictEqual(res.json(), { hello: 'wörld ✓ 😀' })
+})
+
+test('string body accepts string chunks from a preParsing stream', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.addHook('preParsing', async (request, reply, payload) => {
+    payload.setEncoding('utf8')
+    return payload
+  })
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'text/plain' },
+    payload: 'hellö'
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.body, 'hellö')
+})
+
+test('string body with invalid UTF-8 is not treated as a content-length mismatch', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+  fastify.post('/', async (request) => request.body)
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'text/plain' },
+    payload: Buffer.from([0x61, 0xff, 0x62])
+  })
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.strictEqual(res.body, 'a�b')
+})

package/test/content-type-parser-async-context.test.js

@@ -0,0 +1,76 @@
+'use strict'
+
+const { AsyncLocalStorage, AsyncResource, createHook, executionAsyncId } = require('node:async_hooks')
+const { setImmediate: immediate } = require('node:timers/promises')
+const { test } = require('node:test')
+const Fastify = require('..')
+
+test('content type parser callbacks restore request context and destroy their resources', async t => {
+  const storage = new AsyncLocalStorage()
+  const external = new AsyncResource('external-parser')
+  const resources = new Set()
+  const destroyed = new Set()
+  const hook = createHook({
+    init (id, type) {
+      if (type === 'content-type-parser:run') resources.add(id)
+    },
+    destroy (id) {
+      if (resources.has(id)) destroyed.add(id)
+    }
+  }).enable()
+  const app = Fastify()
+  t.after(async () => {
+    hook.disable()
+    external.emitDestroy()
+    storage.disable()
+    await app.close()
+  })
+
+  app.addHook('onRequest', (request, reply, done) => {
+    storage.run({ id: request.headers['x-request-id'] }, done)
+  })
+
+  app.addContentTypeParser('application/custom', { parseAs: 'string' }, (request, body, done) => {
+    external.runInAsyncScope(() => {
+      t.assert.strictEqual(storage.getStore(), undefined)
+      setImmediate(() => {
+        if (body === 'error') {
+          done(new Error('parser failed'))
+        } else {
+          done(null, body)
+        }
+      })
+    })
+  })
+
+  function assertContext (request) {
+    t.assert.deepStrictEqual(storage.getStore(), { id: request.headers['x-request-id'] })
+    t.assert.ok(resources.has(executionAsyncId()))
+  }
+
+  app.setErrorHandler((error, request, reply) => {
+    assertContext(request)
+    reply.code(400).send({ error: error.message, id: storage.getStore().id })
+  })
+  app.post('/', (request, reply) => {
+    assertContext(request)
+    return { body: request.body, id: storage.getStore().id }
+  })
+
+  const responses = await Promise.all(['first', 'second', 'error'].map(id => app.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/custom', 'x-request-id': id },
+    payload: id
+  })))
+
+  t.assert.deepStrictEqual(responses.map(response => response.statusCode), [200, 200, 400])
+  t.assert.deepStrictEqual(responses.map(response => response.json()), [
+    { body: 'first', id: 'first' },
+    { body: 'second', id: 'second' },
+    { error: 'parser failed', id: 'error' }
+  ])
+  await immediate()
+  t.assert.strictEqual(resources.size, 3)
+  t.assert.deepStrictEqual(destroyed, resources)
+})

package/test/custom-parser.4.test.js

@@ -6,6 +6,46 @@ const jsonParser = require('fast-json-body')
 
 process.removeAllListeners('warning')
 
+test('parameterized parser matches preserve precedence and encapsulation on repeated requests', async t => {
+  const fastify = Fastify()
+  t.after(() => fastify.close())
+
+  fastify.addContentTypeParser('application/custom', { parseAs: 'string' }, (request, body, done) => {
+    done(null, 'parent')
+  })
+  fastify.addContentTypeParser('application/custom; version=2', { parseAs: 'string' }, (request, body, done) => {
+    done(null, 'version 2')
+  })
+  fastify.post('/', request => request.body)
+
+  fastify.register(async child => {
+    child.removeContentTypeParser('application/custom')
+    child.addContentTypeParser('application/custom', { parseAs: 'string' }, (request, body, done) => {
+      done(null, 'child')
+    })
+    child.post('/child', request => request.body)
+  })
+
+  for (let i = 0; i < 3; i++) {
+    for (const [url, contentType, expected] of [
+      ['/', 'application/custom; charset=utf-8', 'parent'],
+      ['/child', 'application/custom; charset=utf-8', 'child'],
+      ['/', 'application/custom; version=2', 'version 2'],
+      ['/child', 'application/custom; version=2', 'version 2'],
+      ['/', 'Application/Custom ; Charset="utf-8"', 'parent']
+    ]) {
+      const response = await fastify.inject({
+        method: 'POST',
+        url,
+        headers: { 'content-type': contentType },
+        payload: 'body'
+      })
+      t.assert.strictEqual(response.statusCode, 200)
+      t.assert.strictEqual(response.body, expected)
+    }
+  }
+})
+
 test('should prefer string content types over RegExp ones', async (t) => {
   t.plan(6)
   const fastify = Fastify()

package/test/http2/plain.test.js

@@ -68,6 +68,51 @@ test('http2 plain test', async t => {
   })
 })
 
+test('http2 response trailers do not use transfer-encoding', async t => {
+  const fastify = Fastify({ http2: true })
+
+  fastify.get('/', async (request, reply) => {
+    reply.trailer('x-checksum', async () => 'abc')
+    return 'hello'
+  })
+
+  await fastify.listen({ port: 0, host: '127.0.0.1' })
+
+  const client = http2.connect(`http://127.0.0.1:${fastify.server.address().port}`)
+  t.after(() => {
+    client.close()
+    return fastify.close()
+  })
+
+  const response = await new Promise((resolve, reject) => {
+    const request = client.request({
+      [http2.constants.HTTP2_HEADER_METHOD]: http2.constants.HTTP2_METHOD_GET,
+      [http2.constants.HTTP2_HEADER_PATH]: '/'
+    })
+    const result = { body: '' }
+
+    request.setEncoding('utf8')
+    request.on('response', headers => {
+      result.headers = headers
+    })
+    request.on('trailers', trailers => {
+      result.trailers = trailers
+    })
+    request.on('data', chunk => {
+      result.body += chunk
+    })
+    request.on('error', reject)
+    request.on('end', () => resolve(result))
+    request.end()
+  })
+
+  t.assert.strictEqual(response.headers[':status'], 200)
+  t.assert.strictEqual(response.headers['transfer-encoding'], undefined)
+  t.assert.strictEqual(response.headers.trailer, 'x-checksum')
+  t.assert.strictEqual(response.body, 'hello')
+  t.assert.strictEqual(response.trailers['x-checksum'], 'abc')
+})
+
 test('http2 large non-stream replies are sent completely', async t => {
   const modes = ['buffer', 'string']
 

package/test/internals/errors.test.js

@@ -5,7 +5,7 @@ const errors = require('../../lib/errors')
 const { readFileSync } = require('node:fs')
 const { resolve } = require('node:path')
 
-const expectedErrors = 95
+const expectedErrors = 94
 
 test(`should expose ${expectedErrors} errors`, t => {
   t.plan(1)
@@ -790,16 +790,6 @@ test('FST_ERR_ROUTE_MISSING_CONTENT_TYPE', t => {
   t.assert.ok(error instanceof Error)
 })
 
-test('FST_ERR_ROUTE_MISSING_CONTENT', t => {
-  t.plan(5)
-  const error = new errors.FST_ERR_ROUTE_MISSING_CONTENT()
-  t.assert.strictEqual(error.name, 'FastifyError')
-  t.assert.strictEqual(error.code, 'FST_ERR_ROUTE_MISSING_CONTENT')
-  t.assert.strictEqual(error.message, "Method '%s' must provide a request body.")
-  t.assert.strictEqual(error.statusCode, 400)
-  t.assert.ok(error instanceof Error)
-})
-
 test('FST_ERR_REOPENED_CLOSE_SERVER', t => {
   t.plan(5)
   const error = new errors.FST_ERR_REOPENED_CLOSE_SERVER()

package/test/internals/reply-serialize.test.js

@@ -712,3 +712,23 @@ test('Reply#serializeInput', async t => {
     })
   })
 })
+
+test('Reply#compileSerializationSchema omits absent metadata instead of passing null', async t => {
+  t.plan(2)
+
+  const fastify = Fastify()
+
+  fastify.setSerializerCompiler(({ httpStatus, contentType }) => {
+    t.assert.strictEqual(httpStatus, undefined)
+    t.assert.strictEqual(contentType, undefined)
+
+    return input => JSON.stringify(input)
+  })
+
+  fastify.get('/', (req, reply) => {
+    reply.compileSerializationSchema(getDefaultSchema())
+    reply.send({ hello: 'world' })
+  })
+
+  await fastify.inject({ path: '/', method: 'GET' })
+})

package/test/internals/reply.test.js

@@ -35,7 +35,7 @@ const doGet = async function (url) {
 
 test('Once called, Reply should return an object with methods', t => {
   t.plan(16)
-  const response = { res: 'res' }
+  const response = { res: 'res', getHeader: () => undefined }
   const context = {
     config: { onSend: [] },
     schema: {},
@@ -1003,6 +1003,35 @@ test('reply can set multiple instances of same header', async t => {
   t.assert.deepStrictEqual(result.headers.getSetCookie(), ['one', 'two'])
 })
 
+test('reply.header does not mutate a set-cookie array passed by the caller', async t => {
+  t.plan(5)
+
+  const fastify = require('../../')()
+  const defaults = ['a=1']
+
+  fastify.get('/headers', function (req, reply) {
+    reply
+      .header('set-cookie', defaults)
+      .header('set-cookie', 'b=2')
+      .send({})
+  })
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+  t.after(() => fastify.close())
+
+  const first = await fetch(`${fastifyServer}/headers`)
+  t.assert.deepStrictEqual(first.headers.getSetCookie(), ['a=1', 'b=2'])
+  const second = await fetch(`${fastifyServer}/headers`)
+  t.assert.deepStrictEqual(second.headers.getSetCookie(), ['a=1', 'b=2'])
+  t.assert.deepStrictEqual(defaults, ['a=1'])
+
+  const reply = new Reply({ setHeader () {}, removeHeader () {} }, {}, {})
+  const cookies = ['one']
+  reply.header('set-cookie', cookies).header('set-cookie', 'two')
+  t.assert.deepStrictEqual(reply.getHeader('set-cookie'), ['one', 'two'])
+  t.assert.deepStrictEqual(cookies, ['one'])
+})
+
 test('reply.hasHeader returns correct values', async t => {
   t.plan(2)