FastAPI HTTPException drops cookies set on injected response: Response, return JSONResponse to keep them

In FastAPI, attaching response.set_cookie(...) or response.delete_cookie(...) to the injected Response dependency only takes effect when the handler returns normally. When the handler raises HTTPException, the default exception handler builds a fresh response and the cookies you set are silently discarded. This bites endpoints that want to clear an HttpOnly auth cookie on a 401: the test sees an empty Set-Cookie header even though the handler called delete_cookie before raising. Verified against fastapi 0.115 / starlette 0.40 in 2026-05.

For error paths that need to attach Set-Cookie (clear/rotate auth cookies on 401, etc.), return fastapi.responses.JSONResponse directly with the cookie attached, rather than raising HTTPException. Reserve HTTPException for failures whose response shape is purely status + body and that don't need to mutate response headers.