fix(core): Support joined set-cookie headers (split them) (#24659)

Follow-up to this discussion:
#24536 (comment)

Author: s1gr1d

packages/core/src/utils/cookie.ts

@@ -46,7 +46,9 @@ export function parseCookieHeader(value: string | string[], headerName: 'cookie'
     if (typeof headerValue !== 'string') {
       return [];
     }
-    return headerName === 'set-cookie' ? [headerValue.split(';')[0]!] : headerValue.split(';');
+    return headerName === 'set-cookie'
+      ? splitJoinedSetCookieHeader(headerValue).map(cookie => cookie.split(';')[0]!)
+      : headerValue.split(';');
   });
 
   return (
@@ -66,6 +68,15 @@ export function parseCookieHeader(value: string | string[], headerName: 'cookie'
   );
 }
 
+/**
+ * No SDK path reads a joined header today, but `Headers.get('set-cookie')` and `xhr.getResponseHeader()`
+ * join repeated `Set-Cookie` headers with ", ". A "," only starts a new cookie when a "name=" follows
+ * before the next ";" or ",", so the "," in `Expires=Wed, 21 Oct 2026 07:28:00 GMT` does not split.
+ */
+function splitJoinedSetCookieHeader(headerValue: string): string[] {
+  return headerValue.split(/,(?=[^;=,]*=)/);
+}
+
 /**
  * Converts cookie pairs to a record with decoded values. The first cookie of a name wins.
  *

packages/core/test/lib/utils/cookie.test.ts

@@ -122,6 +122,40 @@ describe('parseCookieHeader', () => {
       expect(parseCookieHeader('; HttpOnly', 'set-cookie')).toEqual([]);
     });
 
+    it.each([
+      [
+        'sid=s3cr3t; Path=/, theme=dark; Path=/',
+        [
+          ['sid', 's3cr3t'],
+          ['theme', 'dark'],
+        ],
+      ],
+      [
+        'sid=s3cr3t; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/, theme=dark',
+        [
+          ['sid', 's3cr3t'],
+          ['theme', 'dark'],
+        ],
+      ],
+      [
+        'sid=s3cr3t; Expires=Wed, 21 Oct 2026 07:28:00 GMT, theme=dark',
+        [
+          ['sid', 's3cr3t'],
+          ['theme', 'dark'],
+        ],
+      ],
+      ['sid=s3cr3t; Expires=Wed, 21 Oct 2026 07:28:00 GMT', [['sid', 's3cr3t']]],
+      [
+        'sid=s3cr3t,theme=dark',
+        [
+          ['sid', 's3cr3t'],
+          ['theme', 'dark'],
+        ],
+      ],
+    ])('splits headers joined with "," in %j', (header, expected) => {
+      expect(parseCookieHeader(header, 'set-cookie')).toEqual(expected);
+    });
+
     it('returns one pair per header value', () => {
       expect(parseCookieHeader(['theme=dark; HttpOnly', 'sid=s3cr3t; Secure'], 'set-cookie')).toEqual([
         ['theme', 'dark'],

packages/core/test/lib/utils/data-collection/filterCookies.test.ts

@@ -122,6 +122,16 @@ describe('filterCookies', () => {
       ).toEqual({ theme: 'dark' });
     });
 
+    it('reads each cookie of several Set-Cookie headers joined with ","', () => {
+      expect(
+        filterCookies(
+          'sid=s3cr3t; Expires=Wed, 21 Oct 2026 07:28:00 GMT; Path=/, theme=dark; Path=/',
+          true,
+          'set-cookie',
+        ),
+      ).toEqual({ sid: '[Filtered]', theme: 'dark' });
+    });
+
     it('filters the token of a nameless cookie', () => {
       expect(filterCookies('y7Uu0Rk2QpLmXv3; HttpOnly; Secure', true, 'set-cookie')).toEqual({ '': '[Filtered]' });
     });