diff --git a/include/authentication.hpp b/include/authentication.hpp
index 4897c0e..0e5e880 100644
--- a/include/authentication.hpp
+++ b/include/authentication.hpp
@@ -199,12 +199,14 @@
             return sp;
         }
         // TODO: change this to not switch to cookie auth
-        res.addHeader("Set-Cookie",
+        res.addHeader(boost::beast::http::field::set_cookie,
                       "XSRF-TOKEN=" + sp->csrfToken +
-                          "; SameSite=Strict; Secure\r\nSet-Cookie: SESSION=" +
-                          sp->sessionToken +
-                          "; SameSite=Strict; Secure; HttpOnly\r\nSet-Cookie: "
-                          "IsAuthenticated=true; Secure");
+                          "; SameSite=Strict; Secure");
+        res.addHeader(boost::beast::http::field::set_cookie,
+                      "SESSION=" + sp->sessionToken +
+                          "; SameSite=Strict; Secure; HttpOnly");
+        res.addHeader(boost::beast::http::field::set_cookie,
+                      "IsAuthenticated=true; Secure");
         BMCWEB_LOG_DEBUG << " TLS session: " << sp->uniqueId
                          << " with cookie will be used for this request.";
         return sp;
diff --git a/include/login_routes.hpp b/include/login_routes.hpp
index 122e741..f2e9589 100644
--- a/include/login_routes.hpp
+++ b/include/login_routes.hpp
@@ -196,22 +196,13 @@
                     asyncResp->res.jsonValue["message"] = "200 OK";
                     asyncResp->res.jsonValue["status"] = "ok";
 
-                    // Hack alert.  Boost beast by default doesn't let you
-                    // declare multiple headers of the same name, and in
-                    // most cases this is fine.  Unfortunately here we need
-                    // to set the Session cookie, which requires the
-                    // httpOnly attribute, as well as the XSRF cookie, which
-                    // requires it to not have an httpOnly attribute. To get
-                    // the behavior we want, we simply inject the second
-                    // "set-cookie" string into the value header, and get
-                    // the result we want, even though we are technicaly
-                    // declaring two headers here.
                     asyncResp->res.addHeader(
-                        "Set-Cookie",
+                        boost::beast::http::field::set_cookie,
                         "XSRF-TOKEN=" + session->csrfToken +
-                            "; SameSite=Strict; Secure\r\nSet-Cookie: "
-                            "SESSION=" +
-                            session->sessionToken +
+                            "; SameSite=Strict; Secure");
+                    asyncResp->res.addHeader(
+                        boost::beast::http::field::set_cookie,
+                        "SESSION=" + session->sessionToken +
                             "; SameSite=Strict; Secure; HttpOnly");
                 }
                 else