fix: error when reading non-serialized set-cookie headers in load

.changeset/quick-cookies-guarded.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: error when reading non-serialized `set-cookie` headers via `getSetCookie` in `load`

packages/kit/src/runtime/server/page/load_data.js

@@ -482,6 +482,21 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts)
 
 				return value;
 			};
+
+			const get_set_cookie = response.headers.getSetCookie;
+			response.headers.getSetCookie = () => {
+				const values = get_set_cookie.call(response.headers);
+				for (const value of values) {
+					const included = resolve_opts.filterSerializedResponseHeaders('set-cookie', value);
+					if (!included) {
+						throw new Error(
+							`Failed to get response header "set-cookie" — it must be included by the \`filterSerializedResponseHeaders\` option: https://svelte.dev/docs/kit/hooks#handle (at ${event.route.id})`
+						);
+					}
+				}
+
+				return values;
+			};
 		}
 
 		return proxy;

packages/kit/src/runtime/server/page/load_data.spec.js

@@ -73,3 +73,15 @@ test('errors when trying to access non-serialized request headers on the server'
 		/Failed to get response header "content-type" — it must be included by the `filterSerializedResponseHeaders` option/
 	);
 });
+
+test('errors when trying to access non-serialized set-cookie headers on the server', async () => {
+	const fetch = create_fetch({
+		// eslint-disable-next-line @typescript-eslint/require-await
+		fetch: async () => new Response('foo', { headers: { 'set-cookie': 'a=1' } })
+	});
+	const response = await fetch('https://domain-a.com');
+	assert.throws(
+		() => response.headers.getSetCookie(),
+		/Failed to get response header "set-cookie" — it must be included by the `filterSerializedResponseHeaders` option/
+	);
+});