Unable to set headers with cookie after sending json response - node.js

Question

Building out some basic login functionality with JWT's and I am running into an error with setting the cookie... Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
From what I have seen it is because of the middleware going to next and not ending the previous... I just tried res.end(data) while assigning the constant data to the json response. Any advice?
router.post('/users/login', async (req, res) => {
try {
let userInput = {
email: req.body.email,
password: req.body.password
}
const userCheck = await User.findOne({ email: req.body.email })
if (!userCheck) {
res.json("No User with that email!")
} else {
const valid = await bcrypt.compare(req.body.password, userCheck.password)
if (!valid) {
res.json("Invalid password for " + userCheck.email)
} else {
try {
const refreshToken = jsonwebtoken.sign({ userId: userCheck._id }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: '7d' })
const accessToken = jsonwebtoken.sign({ userId: userCheck._id, }, process.env.ACCESS_TOKEN_SECRET, { expiresIn: '15m' })
res.json("AccessToken: " + accessToken)
res.cookie("bearer", refreshToken, {
httpOnly: true
})
} catch (err) {
res.json("Error: " + err)
}
}
}
} catch (err) {
res.status(400).json("Error: " + err)
}
})

Answer 1

You just have to call res.cookie() BEFORE you send the response with res.json(). res.cookie() sets the cookie header for the response and that has to be in place before the response is sent. When you call res.json() all headers that have already been configured are sent with the response and you can no longer set any more headers because the response will have already been sent and you only get to send one response.
So, change this:
try {
const refreshToken = jsonwebtoken.sign({ userId: userCheck._id }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: '7d' })
const accessToken = jsonwebtoken.sign({ userId: userCheck._id, }, process.env.ACCESS_TOKEN_SECRET, { expiresIn: '15m' })
res.json("AccessToken: " + accessToken)
res.cookie("bearer", refreshToken, {
httpOnly: true
})
} catch (err) {
res.json("Error: " + err)
}
to this:
try {
const refreshToken = jsonwebtoken.sign({ userId: userCheck._id }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: '7d' })
const accessToken = jsonwebtoken.sign({ userId: userCheck._id, }, process.env.ACCESS_TOKEN_SECRET, { expiresIn: '15m' })
res.cookie("bearer", refreshToken, { // <== This goes before res.json()
httpOnly: true
})
res.json("AccessToken: " + accessToken)
} catch (err) {
res.json("Error: " + err)
}