Repository navigation
http.cookies, Cookie.py: Improper handling of duplicate cookies #42664
Description
| BPO | 1375011 |
|---|---|
| Nosy | @Cito, @devdanzin, @karlcow |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2005-12-07.03:50:53.000>
labels = ['easy', 'type-bug', '3.8', '3.9', '3.10', 'library']
title = 'http.cookies, Cookie.py: Improper handling of duplicate cookies'
updated_at = <Date 2021-01-21.15:12:28.480>
user = 'https://bugs.python.org/valankar'bugs.python.org fields:
activity = <Date 2021-01-21.15:12:28.480>
actor = 'cito'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2005-12-07.03:50:53.000>
creator = 'valankar'
dependencies = []
files = ['6910', '29178', '29179']
hgrepos = []
issue_num = 1375011
keywords = ['patch', 'easy']
message_count = 8.0
messages = ['49178', '49179', '86297', '114634', '182758', '182759', '353845', '385430']
nosy_count = 7.0
nosy_names = ['jjlee', 'cito', 'sonderblade', 'valankar', 'ajaksu2', 'karlcow', 'mmelin']
pr_nums = []
priority = 'normal'
resolution = None
stage = 'test needed'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue1375011'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']
Activity
valankar commentedon Dec 7, 2005
This patch implements part of bug 1372650.
Sometimes a web client will send 2 instances of the same name:
Cookie: mycookie=foo; mycookie=bar
The specs listed here:
http://wp.netscape.com/newsref/std/cookie_spec.html
state that the first one is the one that should be used. The other
cookies listed are the inherited ones from paths that a prefix of the
current URL. When this is parsed by the Cookie module, mycookie gets
set to bar when it should be foo.
This patch changes Cookie.py to only use the first instance of duplicate
cookies when parsing cookie strings.
sonderblade commentedon Mar 14, 2007
That link is misleading and just confuses you. :) Instead read John J. Lee's great explanation at the referenced bug report. I have tested the patch and it works as expected. Without the patch:
With the patch:
There should be a unit test though and something in the documentation. The keys dict should be a set instead.
devdanzin commentedon Apr 22, 2009
See discussion in bpo-1372650.
BreamoreBoy commentedon Aug 22, 2010
Even if the patch is still valid there are still no doc or unit test changes.
mmelin commentedon Feb 23, 2013
Attached is a patch with Viraj's original fix except using a set instead of a dict as suggested by Björn. This patch also includes a test case and a note in the docs about this behavior.
Since Cookie has been moved and the code has been cleaned up somewhat between 2.7 and 3.2 I'm attaching patches for both branches.
Of course, a decision still needs to be made whether or not this should be applied; the behavior is more correct now, but I don't know if it is worth potentially breaking applications that have come to expect the old behavior. There doesn't seem to be a consensus in bpo-1372650 but I thought having a complete patch would be a good thing regardless.
mmelin commentedon Feb 23, 2013
Just adding the 3.2 patch
[-]Improper handling of duplicate cookies[/-][+]http.cookies, Cookie.py: Improper handling of duplicate cookies[/+][-]Improper handling of duplicate cookies[/-][+]http.cookies, Cookie.py: Improper handling of duplicate cookies[/+]karlcow commentedon Oct 3, 2019
Relevant spec
https://tools.ietf.org/html/rfc6265
9 remaining items
Hyper-glitch commentedon Jun 9, 2023
Hi! Sorry, I am very new in open source...
Could you help me how can I assigned this issue for me?
arhadthedev commentedon Jun 10, 2023
@Hyper-glitch It's an open project, no preliminary assignment is required. The only thing you need is to follow the contributor's manual at https://devguide.python.org/ where conventions and processes are described.
hadrizi commentedon Sep 26, 2023
@Hyper-glitch are you still working on this?
tavallaie commentedon Mar 6, 2024
@iritkatriel @arhadthedev Based my last PR that waiting for core review I suggest to remove the easy tag from this issue also based on time the issue created and corresponding Core developer opinion on this issue maybe we can close it without accepting my PR.
muravev-vasilii commentedon Jul 13, 2024
Hi everyone,
I am not a core developer and am new to open source, but I want to participate in this issue and help resolve it (mostly out of curiosity and to start being involved in open source Python). The idea came up from a sprint at this year’s EuroPython (https://ep2024.europython.eu/sprints#cpython-core-work-on-python-314).
If I understand correctly, we want to have an up-to-date http.cookies library that conforms to https://datatracker.ietf.org/doc/html/rfc6265, whereas the current cookies library conforms to a relaxed version of RFC 2109/RFC 2965 (as seen in the documentation https://docs.python.org/3/library/http.cookies.html#module-http.cookies and in the code https://github.com/python/cpython/blob/main/Lib/http/cookies.py).
Simply changing the current behavior of http.cookies is dangerous because there are probably users who rely on the current behavior, and silently changing it can break things for them without their knowledge.
At the same time, I found that there is a library that handles cookies according to RFC 6265: https://pypi.org/project/cookies/. However, it is not part of the standard Python library. This library also refers to other implementations.
So, maybe instead of changing the current implementation, we can do one of the following things:
If either option makes sense to the community, I can contribute by doing this. :)