[Bug]: Custom Headers broken with 4.27.0

[aileen]

Summary

We're using custom headers with the next.config.js implementation as described here to allow fetching from a Next.js API endpoint from another domain.

Since 4.27.0 no custom headers are provided response. They're still working fine in 4.26.0

Steps to reproduce

1. Use custom headers in next.config.js with version 4.26.0
2. See headers working for defined paths
3. Upgrade to 4.27.0
4. No headers being added

Response headers before 4.27.0:

Response headers after 4.27.0:

A link to a reproduction repository

Private repo

Next Runtime version

4.27.0

More information about your build

• I am building using the CLI
• I am building using file-based configuration (netlify.toml)

What OS are you using?

No response

Your netlify.toml file

`netlify.toml`

# Paste content of your `netlify.toml` file here

Your public/_redirects file

`_redirects`

# Paste content of your `_redirects` file here

Your next.config.js file

`next.config.js`

const nextConfig = {
    reactStrictMode: true,
    basePath: '/explore',
    trailingSlash: true,
      async headers() {
        return [
        {
            source: '/api/feed',
            headers: [
                {
                    key: 'Access-Control-Allow-Origin',
                    value: '*',
                }
            ],
        },
        {
            source: '/:path*',
            headers: [
                {
                    key: 'X-XSS-Protection',
                    value: '1; mode=block'
                },
                {
                    key: 'X-Content-Type-Options',
                    value: 'nosniff'
                },
                {
                    key: 'Referrer-Policy',
                    value: 'no-referrer-when-downgrade'
                },
                {
                    key: 'Strict-Transport-Security',
                    value: 'max-age=31536000'
                },
                {
                    key: 'Feature-Policy',
                    value: 'accelerometer "none"; camera "none"; geolocation "none"; gyroscope "none"; magnetometer "none"; microphone "none"; payment "none"; usb "none"'
                }
            ]
          }
        ]
      }
}

module.exports = nextConfig

Builds logs (or link to your logs)

Build logs

# Paste logs here

Function logs

Function logs

# Paste logs here

.next JSON files

generated .next JSON files

# Paste file contents here. Please check there isn't any private info in them
# You can either build locally, or download the deploy from Netlify by clicking the arrow next to the deploy time.

[jqlee85]

My team is having the same issue, Set-Cookie headers are not being set on responses from one of our NextJS API endpoints.