set-cookie-parser

set-cookie-parser converts raw Set-Cookie header values into plain JavaScript objects with named fields (name, value, path, domain, expires, maxAge, secure, httpOnly, sameSite, partitioned), removing the need to hand-write a Set-Cookie regex. It accepts a single header string, an array of header values, a Node.js http.IncomingMessage response, or a WHATWG fetch() Response object, and normalizes all of them into the same output shape.

It can return either an array of cookie objects or a name → cookie map ({map: true}), and is commonly paired with the cookie npm package, whose input format its output loosely mirrors — making it a natural fit anywhere server or edge code needs to inspect cookies a backend response is trying to set.

What You Get

• Accepts a single header value, an array, a Node.js response, or a fetch() Response object as input
• Returns an array of cookie objects or, with {map: true}, a name-to-cookie-object map
• Full field parsing: name, value, path, domain, expires, maxAge, secure, httpOnly, sameSite, partitioned
• Optional value decoding via decodeValues (defaults to true)
• Ships as a dual ESM/CJS package with bundled TypeScript type definitions

Common Use Cases

• Inspecting Set-Cookie headers returned by an upstream API in a Node.js HTTP client or proxy
• Reading and forwarding session cookies in serverless/edge functions using the fetch() Response API
• Testing HTTP endpoints that set cookies, by parsing response headers into assertable objects
• Building custom cookie-jar or session-management logic on top of raw fetch/http responses

Under The Hood

Architecture The library is a single module (lib/set-cookie.js, ~270 lines) exposing a small set of functions — parse(), parseString(), splitCookiesString(), and parseSetCookie() — that first split a combined Set-Cookie header string on comma boundaries (careful to avoid splitting inside Expires= date values), then tokenize each cookie string on ; to extract attribute key/value pairs into a plain object. Tech Stack Zero runtime dependencies; it ships as a native ESM module (type: module) with a build step (build-cjs.js) that generates a CommonJS dist/set-cookie.cjs for require() consumers, and devDependencies limited to mocha/sinon for testing, tsd for type-testing, and eslint/prettier for style. Code Quality Tests in test/ cover parsing from raw strings, arrays, Node response objects, and fetch Response objects, with test-d/ providing tsd-based type-level tests to ensure the shipped .d.ts definitions stay accurate; CI runs lint, unit tests, and typecheck on every push. API Design The API surface is intentionally tiny — one main parse() function handling four different input shapes (string, array, Node response, fetch Response) transparently, with an options object (decodeValues, map) covering the only real behavioral variation — making it a near-zero-boilerplate drop-in for any code that already has a response object in hand.