Cloudflare proxy drops duplicate upstream response headers (Set-Cookie) #404

Description

The Cloudflare upstream proxy copies repeated response fields with HeaderMap::insert, overwriting earlier values. Main still has this code in crates/edgezero-adapter-cloudflare/src/proxy.rs:87. PR #379 fixed response conversion, but this upstream path is separate. PR #275 replaces the legacy transport and uses append in its outbound response conversion; its full upstream-to-client contract still needs to be verified for this issue.

Steps to reproduce

Use a fictional upstream fixture returning two distinct Set-Cookie fields and proxy it through Cloudflare. Inspect all client-visible cookie fields rather than one headers.get value. Repeat through the replacement #275 outbound path and final response conversion.

Expected behavior

Both upstream cookie values survive in order as separate Set-Cookie fields. Other repeated fields retain their defined HTTP behavior and malformed fields fail safely.

Impact

Overwriting cookie fields can lose session or preference updates. No production occurrence or payload disclosure is established by this issue.

Proposed fix

Use append at the owning conversion seam and add an actual upstream-to-client repeated-cookie runtime contract. Coordinate with #275 so the fix follows the accepted transport rather than independently restoring retired proxy APIs; a synthetic copy-helper test alone does not prove the whole path.

Done when

• A Cloudflare runtime contract returns both distinct upstream Set-Cookie values through the complete outbound/proxy and response-conversion path.
• The accepted conversion appends repeated fields instead of replacing them.
• Header/body/status behavior and malformed-field failure regressions remain intact.

Related

• Raised in review of PR Add opt-in reusable application lifecycles #379.
• Related replacement implementation: PR feat: implement portable outbound HTTP and request lifecycle contracts #275 / Implement portable outbound HTTP and request lifecycle contracts #436; keep this issue open until its focused upstream response contract is demonstrated.