removeStaticFileCookies method

Response removeStaticFileCookies(Response response)

Removes any Set-Cookie from a static file response when cookieless is on, returning response untouched otherwise.

A cookieless server must not set a cookie in a static file response either, and a static file response is built by the shelf handler, never passing through the API response builder that drops it.

Called again right before the Response is handed over, since a Set-Cookie can be introduced after the headers are configured.

Implementation

Response removeStaticFileCookies(Response response) {
  if (!cookieless) return response;

  // `Response.headers` is case-insensitive and unmodifiable, so the header
  // is removed through `change`, where a `null` value drops the entry:
  if (!response.headers.containsKey(HttpHeaders.setCookieHeader)) {
    return response;
  }

  return response.change(headers: {HttpHeaders.setCookieHeader: null});
}