Repository: next.js
Issue: Setting a cookie in middleware & a server action results in duplicate Set-Cookie headers
Labels: bug,Middleware,linear: next

### Link to the code that reproduces this issue

https://github.com/nphmuller/next-duplicate-set-cookies/commit/b93779fbabcb0cdf16084f7b68443c1bc38581f8

### To Reproduce

See https://github.com/nphmuller/next-duplicate-set-cookies/commit/b93779fbabcb0cdf16084f7b68443c1bc38581f8 for easy repro

1. Create middleware:

```
import { NextResponse } from "next/server";

export default async function Middleware() {
  const response = NextResponse.next();
  response.cookies.set("middleware-repro", "from-middleware");
  return response;
}
```

2. Create server action:

```
"use server";

import { cookies } from "next/headers";

export async function cookieReproAction() {
  const cookieStore = cookies();
  cookieStore.set("middleware-repro", "from-action");
  cookieStore.set("action-repro", "from-action-1");
  cookieStore.set("action-repro", "from-action-2");
}
```

3. Call the server action (for example in an onclick event

### Current vs. Expected behavior

Current cookie related response headers:

```
set-cookie: middleware-repro=from-middleware; Path=/
set-cookie: middleware-repro=from-action; Path=/
set-cookie: action-repro=from-action-2; Path=/
x-middleware-set-cookie: middleware-repro=from-middleware; Path=/
``` 

Expected behaviour:

I would expect the same behaviour as setting the same cookie multiple times in a Server Action.

This means that previous "set-cookie" values for the same cookie name would be overwritten and only the last one set is part of the response.

So I would expect only these `set-cookie` headers:

```
-- the action is called after the middleware, so only set the action
set-cookie: middleware-repro=from-action; Path=/ 
-- this already works as expected. `from-action-1` gets overwritten by `from-action-2`, since it's called last in the Server Action.
set-cookie: action-repro=from-action-2; Path=/
```

It's also weird that `x-middleware-set-cookie` is present in the final response that the browser receives, but I'm not sure if this is expected. I thought that these headers were used for communication between the middleware and server components or server actions. So I expected they would be stripped out in the final response. I could be totally wrong here though.

A good reason for stripping out `the x-middleware` header would be to keep the response header size small. When setting a session cookie in the middleware it would cause the session cookie to be set multiple times in the response headers. This could make the response header too large for most proxy servers, in certain cases.

### Provide environment information

```bash
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 23.6.0: Mon Jul 29 21:14:30 PDT 2024; root:xnu-10063.141.2~1/RELEASE_ARM64_T6000
  Available memory (MB): 32768
  Available CPU cores: 10
Binaries:
  Node: 20.13.0
  npm: 10.8.2
  Yarn: N/A
  pnpm: 9.0.5
Relevant Packages:
  next: 14.2.8 // Latest available version is detected (14.2.8).
  eslint-config-next: 14.2.8
  react: 18.3.1
  react-dom: 18.3.1
  typescript: 5.5.4
Next.js Config:
  output: N/A
```


### Which area(s) are affected? (Select all that apply)

Middleware

### Which stage(s) are affected? (Select all that apply)

next dev (local), next start (local), Vercel (Deployed), Other (Deployed)

### Additional context

I also verified this behaviour in next canary. It behaves exactly the same.

```
 "next": "^15.0.0-canary.143",
 "react": "^19.0.0-rc-4c58fce7-20240904",
 "react-dom": "^19.0.0-rc-4c58fce7-20240904"
```

The `x-middleware-set-cookie` response header is new since Next 14.2.8 (doesn't appear in 14.2.7).
The duplicate `set-cookie` response header has been happening for a long time. Earliest version I tried is Next 13.5.1