From f478812568be424fe93907853a57853ec664adb3 Mon Sep 17 00:00:00 2001
From: Ruben van Dijk <15885455+RubenNL@users.noreply.github.com>
Date: Tue, 8 Jul 2025 06:13:08 +0200
Subject: [PATCH] Allow multiple set-cookie headers with hassio ingress
 (#148148)

---
 homeassistant/components/hassio/ingress.py | 16 ++++++++--------
 tests/components/hassio/test_ingress.py    | 14 +++++++++++++-
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/homeassistant/components/hassio/ingress.py b/homeassistant/components/hassio/ingress.py
index ca6764cfa34..e1f96b76bcb 100644
--- a/homeassistant/components/hassio/ingress.py
+++ b/homeassistant/components/hassio/ingress.py
@@ -239,13 +239,13 @@ def _forwarded_for_header(forward_for: str | None, peer_name: str) -> str:
     return f"{forward_for}, {connected_ip!s}" if forward_for else f"{connected_ip!s}"
 
 
-def _init_header(request: web.Request, token: str) -> CIMultiDict | dict[str, str]:
+def _init_header(request: web.Request, token: str) -> CIMultiDict:
     """Create initial header."""
-    headers = {
-        name: value
+    headers = CIMultiDict(
+        (name, value)
         for name, value in request.headers.items()
         if name not in INIT_HEADERS_FILTER
-    }
+    )
     # Ingress information
     headers[X_HASS_SOURCE] = "core.ingress"
     headers[X_INGRESS_PATH] = f"/api/hassio_ingress/{token}"
@@ -273,13 +273,13 @@ def _init_header(request: web.Request, token: str) -> CIMultiDict | dict[str, st
     return headers
 
 
-def _response_header(response: aiohttp.ClientResponse) -> dict[str, str]:
+def _response_header(response: aiohttp.ClientResponse) -> CIMultiDict:
     """Create response header."""
-    return {
-        name: value
+    return CIMultiDict(
+        (name, value)
         for name, value in response.headers.items()
         if name not in RESPONSE_HEADERS_FILTER
-    }
+    )
 
 
 def _is_websocket(request: web.Request) -> bool:
diff --git a/tests/components/hassio/test_ingress.py b/tests/components/hassio/test_ingress.py
index 069abaa8513..cad410e6a21 100644
--- a/tests/components/hassio/test_ingress.py
+++ b/tests/components/hassio/test_ingress.py
@@ -4,6 +4,7 @@ from http import HTTPStatus
 from unittest.mock import MagicMock, patch
 
 from aiohttp.hdrs import X_FORWARDED_FOR, X_FORWARDED_HOST, X_FORWARDED_PROTO
+from multidict import CIMultiDict
 import pytest
 
 from homeassistant.components.hassio.const import X_AUTH_TOKEN
@@ -28,15 +29,22 @@ async def test_ingress_request_get(
     aioclient_mock.get(
         f"http://127.0.0.1/ingress/{build_type[0]}/{build_type[1]}",
         text="test",
+        headers=CIMultiDict(
+            [("Set-Cookie", "cookie1=value1"), ("Set-Cookie", "cookie2=value2")]
+        ),
     )
 
     resp = await hassio_noauth_client.get(
         f"/api/hassio_ingress/{build_type[0]}/{build_type[1]}",
-        headers={"X-Test-Header": "beer"},
+        headers=CIMultiDict(
+            [("X-Test-Header", "beer"), ("X-Test-Header", "more beer")]
+        ),
     )
 
     # Check we got right response
     assert resp.status == HTTPStatus.OK
+    assert resp.headers["Set-Cookie"] == "cookie1=value1"
+    assert resp.headers.getall("Set-Cookie") == ["cookie1=value1", "cookie2=value2"]
     body = await resp.text()
     assert body == "test"
 
@@ -49,6 +57,10 @@ async def test_ingress_request_get(
         == f"/api/hassio_ingress/{build_type[0]}"
     )
     assert aioclient_mock.mock_calls[-1][3]["X-Test-Header"] == "beer"
+    assert aioclient_mock.mock_calls[-1][3].getall("X-Test-Header") == [
+        "beer",
+        "more beer",
+    ]
     assert aioclient_mock.mock_calls[-1][3][X_FORWARDED_FOR]
     assert aioclient_mock.mock_calls[-1][3][X_FORWARDED_HOST]
     assert aioclient_mock.mock_calls[-1][3][X_FORWARDED_PROTO]