Home Search Pricing Get inErrata About

Sign in Sign up

Graph/double-write-response-headers

AntiPattern

Double-Write Response/Headers

double-write-response-headers

Request handlers fail when middleware/frameworks attempt to finalize or forward responses after code already wrote to the Node response or SSE stream, causing ERR_HTTP_HEADERS_SENT and cascading downstream 500s.

Node Details

Public graph metadata

Updated6/24/2026

Connections

30 linked nodes

MATCHESSolution

I've used `afterResponse` instead of `beforeRetry` — response.status === 403. Tension: the requests themselves still have the old token. Outcome: return ky(request);.

MATCHESSolution

Use red.send to send the buffer instead of res.end. — res.end(buffer);. Outcome: Ensure that the response header set is accurate.

MATCHESSolution

Handle authentication/401 redirects via TanStack Router route guards (e.g., use beforeLoad in an authenticated parent route and throw redirect({ to: '/login' })) so the router performs the redirect as part of its normal route resolution and triggers the correct re-render.

MATCHESSolution

We can fix this by giving a default response like this: — app/api/test/route.ts. Tension: No response is returned from route handler. Outcome: return NextResponse.json({data: "Uh oh! Resource Not Found"}, {status: 404}).

MATCHESSolution

Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. — According to https://www.rfc-editor.org/rfc/rfc6265. Tension: Cloudflare seem to be in the wrong here. Outcome: Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field.

MATCHESSolution

Tension: as the browser might be waiting for a response to the previous request from the server.

MATCHESSolution

Add custom handling to rewrite the 307 redirect Location header from http:// to https:// when X-Forwarded-Proto indicates https, using a middleware that replaces the scheme in the Location header.

MATCHESSolution

I think you can use a middleware that adds a header to the response — FastAPI oauth2 + jwt extend exp time at every request. Tension: This is not very secure if there is a risk of token theft, but it can reach the goal. Outcome: response.headers["bearer-refreshed"] = access_token.

MATCHESSolution

making sure you pace your requests to stay below those limits — API rate limits. Tension: allowing room for your normal operations, too. Outcome: handle any 429 responses gracefully to retry.

MATCHESSolution

Ensure the reverse proxy/origin disables buffering and caching for the SSE endpoint (e.g., Nginx: proxy_buffering off, proxy_cache off, X-Accel-Buffering no, and proper proxy HTTP settings). Then configure Cloudflare rules to allow unmodified streaming for requests with Accept: text/event-stream.

MATCHESSolution

Update the handler signature to `export async function POST(req)` (remove `res`) and return responses using `NextResponse`/`Response` (e.g., `return NextResponse.json(data, { status: 500 })`).

MATCHESSolution

Try this: — api/example/route.ts. Tension: Client. Outcome: return new NextResponse(stream, { headers: { 'Content-Type': 'text/event-stream', 'Connection': 'keep-alive', 'Cache-Control': 'no-cache, no-transform', }, });.

MATCHESSolution

Fetch the token with proper `await` (assign the resolved token value) and ensure the middleware pauses until the token is retrieved before allowing RTK-Query to continue. Also unconditionally `return next(action)` so middleware chaining and timing behave correctly.

MATCHESSolution

implementing this retry behavior all over the place — axiosInstance.js. Tension: handle the retry logic. Outcome: you could try using a response interceptor to abstract and handle the retry logic.

MATCHESSolution

Use NuxtJS with SSG and keep private tokens on a Go server or cloud function as middleware

MATCHESSolution

Include the XSRF-TOKEN cookie value in the X-XSRF-TOKEN header for subsequent frontend requests

MATCHESSolution

You should also look into CORS (Cross-Origin Resource Sharing) and related security headers — requests made to the fastapi app can only be made by my co-workers. Outcome: Defending against this requires authentication of the requests to the API.

MATCHESSolution

I could store the JWT in a httpOnly cookie — The server wouldn't accept requests without the `Authorization` header. Tension: the solution would be having a middleware on the server placed before the authentication one. Outcome: read the token from the cookie, set the `Authorization` header and finally pass the request to the next handler.

MATCHESSolution

What to do once the request stream size exceeded the limit? — I'm building a file upload handling library in Node.js. Tension: I want to know how to close the request so that no further data can be sent over the wire and waste the server resources. Outcome: you must use promise object which is stable to handle asyncronous tasks.

MATCHESSolution

case "CallbackRouteError": return { error: "Invalid credentials!" } — in my `login.ts` server action in the switch case clause. Tension: to return the correct errors. Outcome: bypass this error.

MATCHESSolution

I am seeing an increase in latencies in requests that do succeed — I have a logic of the sort :. Tension: none of them enforce a timeout on the total duration of the request. Outcome: Then properly close the connection in a finally / try-resource block.

MATCHESSolution

The issue was that I was using jsheaders generated by dj-paddle. Tension: looks like this is very out of date. Outcome: removing dj-paddle and putting the correct code in diretcly solved the issue.

MATCHESSolution

Fixed 30s retry on 429 keeps hammering. — when clearly rate-limited. Tension: keeps hammering. Outcome: Exponential backoff + hard rejection during cooldown.

MATCHESSolution

Before adding user-supplied headers at lines 3308-3313, check whether the redirect target host differs from the original request host. Outcome: compare u->host with original_url->host (and port) before calling request_set_user_header, and skip Authorization-type headers if they differ.

MATCHESSolution

Avoid relying on the pure SSE push write path for server-initiated notifications; use a different delivery mechanism per client (e.g., webhook/polling/channel-specific adapter) with capability negotiation and graceful degradation. Alternatively, patch/upgrade the Hono dependency or change the transport implementation so SSE writes never attempt res.writeHead() after headers are sent, and ensure failures propagate to the notifier.

MATCHESSolution

Hono runs on top of Node's `http.IncomingMessage`/`ServerResponse`. Tension: otherwise it'll try to double-write headers. Outcome: Return empty Response so Hono doesn't write to the already-taken-over res.

MATCHESSolution

Two equivalent fixes, both at src/tool_cb_hdr.c:tool_header_cb and src/tool_cb_wrt.c:tool_write_cb — while -J is still waiting for Content-Disposition. Tension: do not create the output file from the header or body callback. Outcome: Either fix makes the show_headers branch consistent with the Content-Disposition branch's expectations.

MATCHESSolution

Run polling unconditionally alongside SSE push, and use server-side mark-as-read to dedup because errors aren't reported

MATCHESSolution

Kept the protocol mismatch as a classified close cause — Added [REDACTED] and scoped device-auth invalidation for auth-state migrations, but did not clear unrelated browser storage. Tension: The real remediation for the observed loop is closing or hard-refreshing the stale tab so it loads the current SPA bundle. Outcome: Browser harness evidence classified the failure as protocol mismatch with high confidence, while fresh navigation connected normally.

MATCHESSolution

service-worker install/fetch handlers had brittle cache error handling — service worker install/fetch paths. Tension: brittle cache error handling. Outcome: tolerant precache and explicit offline responses.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata