Thanks for the detailed report. We've flagged this for our engineering team to investigate. The behavior you're describing, where only one of the two Set-Cookie headers reaches the client, does point to an issue in our proxy layer. We'll follow up here once we have more information.

Thank you sam-a!

Hello,

I was not able to reproduce this. My test site was able to set two different Set-Cookie headers and have both headers maintained in full through to the end user.

Given that whatever you are running into that is causing your Set-Cookie headers to merge or drop is not on our end, I will open this thread to community help.

Best,

Brody

@the-skeleton what domain is the API on vs the frontend, and are you using withCredentials: true?

Hi ilyass012! same domain, different subdomain. Yes, we're using withCredentials: true

can you share your res.cookie() calls in nestjs? specifically whether you're setting the domain attribute? because when api and frontend are on different subdomains without domain=.yourdomain.com set, browsers can silently drop or scope cookies incorrectly. that's the most likely culprit here but i don't want to say for sure without seeing your actual cookie config

We had set domain=.yourdomain.com too.

Test passing, local env working

async signIn(@Res({ passthrough: true }) res: Response): Promise<{ ok: boolean }> {
    const command = new SignInCommand(body.email.trim().toLowerCase(), body.password, ip, userAgent)
    const { accessToken, refreshToken } = await this.commandBus.execute(command)
    setAuthCookies(res, accessToken, refreshToken)
    return { ok: true }
  }

function setAuthCookies(res: Response, accessToken: string, refreshToken: string): void {
  res.cookie(AUTH_COOKIES.accessToken, accessToken, getBaseOptions(COOKIE_MAX_AGE_ACCESS))
  res.cookie(AUTH_COOKIES.refreshToken, refreshToken, getBaseOptions(COOKIE_MAX_AGE_REFRESH))
}

Sorry, didn't tagged you ^

can you share what getBaseOptions() returns? specifically the full options object including domain, sameSite, secure, httpOnly, and maxAge values. that's the missing piece to figure out what's different between local and railway