---
title: "Breaking: #107324 - Streamline PSR-7 Response Header Handling"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:breaking-107324-1755973900"
source: "Changelog/14.0/Breaking-107324-StreamlinePSR7ResponseHeaderHandling.rst"
typo3-version: "14.0"
typo3-major: 14
type: "breaking"
issue: 107324
forge: "https://forge.typo3.org/issues/107324"
tags: ["Frontend", "PHP-API", "ext:core", "ext:extbase", "ext:frontend", "NotScanned"]
rendered: "2026-09-23T15:24:25+00:00"
---

# Breaking: #107324 - Streamline PSR-7 Response Header Handling {#breaking-107324-1755973900}

See [forge#107324](https://forge.typo3.org/issues/107324)

## Description {#description}

The handling of PSR-7 response headers in TYPO3 Core and Extbase has been
unified. Previously, different mechanisms caused inconsistent behavior:

-   **Extbase** only kept the *last* value of a header, discarding all
    previous values (e.g. only one `Set-Cookie` header was possible).
-   **Core** allowed multiple `Set-Cookie` headers, but merged all other
    headers with multiple values into a single comma-separated string.
    According to RFC 9110, this is only valid for headers that explicitly
    support comma-separated lists.

With this change, TYPO3 now preserves multiple header values by default.
Each value is emitted as a separate header line, while single values remain
a single-line header.

## Impact {#impact}

-   Multiple header values are now always emitted as multiple header lines.
-   Extbase and Core responses can now properly emit multiple headers with the
    same name (e.g. `Set-Cookie`, `WWW-Authenticate`, `Link`,
    `xkey`).
-   Extensions that relied on the old merging or overwriting behavior may need
    to be adapted.

## Affected installations {#affected-installations}

Installations are affected if they:

-   Relied on headers being merged into a comma-separated string.
-   Relied on only the last header value being retained in Extbase responses.

## Migration {#migration}

If your use case requires *merged* header values, you must now implement this
explicitly:

```php
use TYPO3\CMS\Core\Http\Response;

$response = new Response();
$values = ['foo', 'bar', 'baz'];
$response = $response->withHeader('X-Foo-Bar', implode(', ', $values));
```

If your use case requires that only the *last* header value is retained, you
must also handle this explicitly in your code:

```php
use TYPO3\CMS\Core\Http\Response;

$response = new Response();
$values = ['foo', 'bar', 'baz'];
$response = $response->withHeader('X-Foo-Bar', end($values));
```

Note: There is another edge case not affected by this change. Multiple Extbase
plugins still cannot set multiple header values with the same name (for
example, two Extbase plugins both setting a `Set-Cookie` header). In this
case, the latter will override the former. Installations affected by this
scenario should resolve it by adding their own middleware.