🐛 Fix duplicated headers set by indirect dependencies (#1386)

* Added test for repeating cookies in response headers

* update `response` headers, status code to match `sub_response` in `solve_dependencies` only if necessary; fix formatting of scottsmith2gmail's test

* restore code coverage, remove dead code from `solve_dependencies`

Co-authored-by: Scott Smith <scott.smith.2@gmail.com>

diff --git a/fastapi/dependencies/utils.py b/fastapi/dependencies/utils.py
index 5ad5d426926af05a3c5ae60377ac94b891bd5f03..4939773552f5eefb79c980c81b4c88ac08941a8d 100644 (file)
--- a/fastapi/dependencies/utils.py
+++ b/fastapi/dependencies/utils.py
@@ -514,13 +514,9 @@ async def solve_dependencies(
             sub_values,
             sub_errors,
             background_tasks,
-            sub_response,
+            _,  # the subdependency returns the same response we have
             sub_dependency_cache,
         ) = solved_result
-        sub_response = cast(Response, sub_response)
-        response.headers.raw.extend(sub_response.headers.raw)
-        if sub_response.status_code:
-            response.status_code = sub_response.status_code
         dependency_cache.update(sub_dependency_cache)
         if sub_errors:
             errors.extend(sub_errors)

diff --git a/tests/test_repeated_cookie_headers.py b/tests/test_repeated_cookie_headers.py
new file mode 100644 (file)
index 0000000..4a1913a
--- /dev/null
+++ b/tests/test_repeated_cookie_headers.py
@@ -0,0 +1,34 @@
+from fastapi import Depends, FastAPI, Response
+from fastapi.testclient import TestClient
+
+app = FastAPI()
+
+
+def set_cookie(*, response: Response):
+    response.set_cookie("cookie-name", "cookie-value")
+    return {}
+
+
+def set_indirect_cookie(*, dep: str = Depends(set_cookie)):
+    return dep
+
+
+@app.get("/directCookie")
+def get_direct_cookie(dep: str = Depends(set_cookie)):
+    return {"dep": dep}
+
+
+@app.get("/indirectCookie")
+def get_indirect_cookie(dep: str = Depends(set_indirect_cookie)):
+    return {"dep": dep}
+
+
+client = TestClient(app)
+
+
+def test_cookie_is_set_once():
+    direct_response = client.get("/directCookie")
+    indirect_response = client.get("/indirectCookie")
+    assert (
+        direct_response.headers["set-cookie"] == indirect_response.headers["set-cookie"]
+    )