diff --git a/http/http_response.hpp b/http/http_response.hpp
index 1a4ef16..93c90d7 100644
--- a/http/http_response.hpp
+++ b/http/http_response.hpp
@@ -29,12 +29,17 @@
 
     void addHeader(std::string_view key, std::string_view value)
     {
-        stringResponse->set(key, value);
+        stringResponse->insert(key, value);
     }
 
     void addHeader(boost::beast::http::field key, std::string_view value)
     {
-        stringResponse->set(key, value);
+        stringResponse->insert(key, value);
+    }
+
+    void clearHeader(boost::beast::http::field key)
+    {
+        stringResponse->erase(key);
     }
 
     Response() : stringResponse(response_type{}) {}
diff --git a/include/authentication.hpp b/include/authentication.hpp
index 4897c0e..0e5e880 100644
--- a/include/authentication.hpp
+++ b/include/authentication.hpp
@@ -199,12 +199,14 @@
             return sp;
         }
         // TODO: change this to not switch to cookie auth
-        res.addHeader("Set-Cookie",
+        res.addHeader(boost::beast::http::field::set_cookie,
                       "XSRF-TOKEN=" + sp->csrfToken +
-                          "; SameSite=Strict; Secure\r\nSet-Cookie: SESSION=" +
-                          sp->sessionToken +
-                          "; SameSite=Strict; Secure; HttpOnly\r\nSet-Cookie: "
-                          "IsAuthenticated=true; Secure");
+                          "; SameSite=Strict; Secure");
+        res.addHeader(boost::beast::http::field::set_cookie,
+                      "SESSION=" + sp->sessionToken +
+                          "; SameSite=Strict; Secure; HttpOnly");
+        res.addHeader(boost::beast::http::field::set_cookie,
+                      "IsAuthenticated=true; Secure");
         BMCWEB_LOG_DEBUG << " TLS session: " << sp->uniqueId
                          << " with cookie will be used for this request.";
         return sp;
diff --git a/include/login_routes.hpp b/include/login_routes.hpp
index 122e741..f2e9589 100644
--- a/include/login_routes.hpp
+++ b/include/login_routes.hpp
@@ -196,22 +196,13 @@
                     asyncResp->res.jsonValue["message"] = "200 OK";
                     asyncResp->res.jsonValue["status"] = "ok";
 
-                    // Hack alert.  Boost beast by default doesn't let you
-                    // declare multiple headers of the same name, and in
-                    // most cases this is fine.  Unfortunately here we need
-                    // to set the Session cookie, which requires the
-                    // httpOnly attribute, as well as the XSRF cookie, which
-                    // requires it to not have an httpOnly attribute. To get
-                    // the behavior we want, we simply inject the second
-                    // "set-cookie" string into the value header, and get
-                    // the result we want, even though we are technicaly
-                    // declaring two headers here.
                     asyncResp->res.addHeader(
-                        "Set-Cookie",
+                        boost::beast::http::field::set_cookie,
                         "XSRF-TOKEN=" + session->csrfToken +
-                            "; SameSite=Strict; Secure\r\nSet-Cookie: "
-                            "SESSION=" +
-                            session->sessionToken +
+                            "; SameSite=Strict; Secure");
+                    asyncResp->res.addHeader(
+                        boost::beast::http::field::set_cookie,
+                        "SESSION=" + session->sessionToken +
                             "; SameSite=Strict; Secure; HttpOnly");
                 }
                 else
diff --git a/test/redfish-core/include/redfish_aggregator_test.cpp b/test/redfish-core/include/redfish_aggregator_test.cpp
index 055d137..83e4b4e 100644
--- a/test/redfish-core/include/redfish_aggregator_test.cpp
+++ b/test/redfish-core/include/redfish_aggregator_test.cpp
@@ -438,7 +438,7 @@
     convertToSat(resp);
 
     // Ignore the satellite even though otherwise valid
-    resp.addHeader("Content-Type", "");
+    resp.clearHeader(boost::beast::http::field::content_type);
 
     RedfishAggregator::processCollectionResponse("prefix", asyncResp, resp);
     EXPECT_EQ(asyncResp->res.getHeaderValue("OData-Version"), "4.0");