🐛 Fix duplicated headers set by indirect dependencies (#1386)

* Added test for repeating cookies in response headers

* update `response` headers, status code to match `sub_response` in `solve_dependencies` only if necessary; fix formatting of scottsmith2gmail's test

* restore code coverage, remove dead code from `solve_dependencies`

Co-authored-by: Scott Smith <scott.smith.2@gmail.com>

fastapi/dependencies/utils.py

@@ -514,13 +514,9 @@ async def solve_dependencies(
             sub_values,
             sub_errors,
             background_tasks,
-            sub_response,
+            _,  # the subdependency returns the same response we have
             sub_dependency_cache,
         ) = solved_result
-        sub_response = cast(Response, sub_response)
-        response.headers.raw.extend(sub_response.headers.raw)
-        if sub_response.status_code:
-            response.status_code = sub_response.status_code
         dependency_cache.update(sub_dependency_cache)
         if sub_errors:
             errors.extend(sub_errors)

tests/test_repeated_cookie_headers.py

@@ -0,0 +1,34 @@
+from fastapi import Depends, FastAPI, Response
+from fastapi.testclient import TestClient
+
+app = FastAPI()
+
+
+def set_cookie(*, response: Response):
+    response.set_cookie("cookie-name", "cookie-value")
+    return {}
+
+
+def set_indirect_cookie(*, dep: str = Depends(set_cookie)):
+    return dep
+
+
+@app.get("/directCookie")
+def get_direct_cookie(dep: str = Depends(set_cookie)):
+    return {"dep": dep}
+
+
+@app.get("/indirectCookie")
+def get_indirect_cookie(dep: str = Depends(set_indirect_cookie)):
+    return {"dep": dep}
+
+
+client = TestClient(app)
+
+
+def test_cookie_is_set_once():
+    direct_response = client.get("/directCookie")
+    indirect_response = client.get("/indirectCookie")
+    assert (
+        direct_response.headers["set-cookie"] == indirect_response.headers["set-cookie"]
+    )