Set-Cookie header missing in non-200 responses forwarded responses from Authorization Hook

[Kashish3009]

Description

We are using Hasura’s authorization hook to refresh session tokens. If the action returns an error, the set-cookie header is not forwarded in the response, despite session updates in the DB. This results in a client-server session mismatch, where the client continues using an outdated authentication cookie.

Proposed Solution

The set-cookie header should be included even on non-200 responses, per RFC 6265.

Steps to Reproduce

1. Use an action with authentication hook.
2. Refresh session token.
3. Action returns an error.
4. The set-cookie header is missing from the response.

Alternative

No effective alternatives available yet.

[ciphrd]

Reported here too: #8407