[Cookies] Match array-based cookie domains case-insensitively

CHANGELOG.md

@@ -9,6 +9,7 @@
 - [Request] Treat IPv6 literals as non-domain hosts.
 - [Router] Fall back to `SERVER_NAME` when deriving exact host constraints.
 - [Cookies] Use request host fallback when resolving cookie domains.
+- [Cookies] Match array-based cookie domains case-insensitively.
 
 ## [1.25.1] - 2026-06-08
 

lib/rage/cookies.rb

@@ -208,7 +208,7 @@ def []=(key, value)
       elsif domain == :all
         DomainName(host).domain
       elsif domain.is_a?(Array)
-        host if domain.include?(host)
+        domain.find { |candidate| candidate.casecmp?(host) } if host
       end
     end
 

spec/controller/api/cookies_spec.rb

@@ -310,6 +310,32 @@
         end
       end
 
+      context "when request host uses different casing" do
+        let(:request_host) { "COOKIE.TEST.COM" }
+
+        it "correctly sets domain value" do
+          subject.cookies[:user_id] = {
+            domain: %w(api.test.com cookie.test.com),
+            value: 120
+          }
+
+          expect(response_cookies[:user_id]).to eq("120; domain=cookie.test.com")
+        end
+      end
+
+      context "when request host uses different casing and includes a port" do
+        let(:request_host) { "COOKIE.TEST.COM:3000" }
+
+        it "correctly sets domain value" do
+          subject.cookies[:user_id] = {
+            domain: %w(api.test.com cookie.test.com),
+            value: 120
+          }
+
+          expect(response_cookies[:user_id]).to eq("120; domain=cookie.test.com")
+        end
+      end
+
       context "when request uses SERVER_NAME fallback" do
         let(:request_env) do
           {