http.cookies, Cookie.py: Improper handling of duplicate cookies

[valankar]

BPO	1375011
Nosy	@Cito, @devdanzin, @karlcow
Files	Cookie.py.patch: Patch for revision 41632 of Cookie.py issue1375011-2.7.patch: Patch, test & docs for Cookie.py on 2.7 issue1375011-3.2.patch: Patch, test & docs for http/cookies.py on 3.2

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2005-12-07.03:50:53.000>
labels = ['easy', 'type-bug', '3.8', '3.9', '3.10', 'library']
title = 'http.cookies, Cookie.py: Improper handling of duplicate cookies'
updated_at = <Date 2021-01-21.15:12:28.480>
user = 'https://bugs.python.org/valankar'

bugs.python.org fields:

activity = <Date 2021-01-21.15:12:28.480>
actor = 'cito'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2005-12-07.03:50:53.000>
creator = 'valankar'
dependencies = []
files = ['6910', '29178', '29179']
hgrepos = []
issue_num = 1375011
keywords = ['patch', 'easy']
message_count = 8.0
messages = ['49178', '49179', '86297', '114634', '182758', '182759', '353845', '385430']
nosy_count = 7.0
nosy_names = ['jjlee', 'cito', 'sonderblade', 'valankar', 'ajaksu2', 'karlcow', 'mmelin']
pr_nums = []
priority = 'normal'
resolution = None
stage = 'test needed'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue1375011'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

Linked PRs

• gh-42664: Preserve first instance of duplicate cookies as per RFC 6265 #116253

[valankar]

This patch implements part of bug 1372650.

Sometimes a web client will send 2 instances of the same name:

Cookie: mycookie=foo; mycookie=bar

The specs listed here:

http://wp.netscape.com/newsref/std/cookie_spec.html

state that the first one is the one that should be used. The other
cookies listed are the inherited ones from paths that a prefix of the
current URL. When this is parsed by the Cookie module, mycookie gets
set to bar when it should be foo.

This patch changes Cookie.py to only use the first instance of duplicate
cookies when parsing cookie strings.

[sonderblade]

That link is misleading and just confuses you. :) Instead read John J. Lee's great explanation at the referenced bug report. I have tested the patch and it works as expected. Without the patch:

>>> c = SimpleCookie('foo=33;foo=34')
>>> print c
Set-Cookie: foo=34

With the patch:

>>> c = SimpleCookie('foo=33;foo=34')
>>> print c
Set-Cookie: foo=33

There should be a unit test though and something in the documentation. The keys dict should be a set instead.

[devdanzin]

See discussion in bpo-1372650.

[BreamoreBoy]

Even if the patch is still valid there are still no doc or unit test changes.

[mmelin]

Attached is a patch with Viraj's original fix except using a set instead of a dict as suggested by Björn. This patch also includes a test case and a note in the docs about this behavior.

Since Cookie has been moved and the code has been cleaned up somewhat between 2.7 and 3.2 I'm attaching patches for both branches.

Of course, a decision still needs to be made whether or not this should be applied; the behavior is more correct now, but I don't know if it is worth potentially breaking applications that have come to expect the old behavior. There doesn't seem to be a consensus in bpo-1372650 but I thought having a complete patch would be a good thing regardless.

[mmelin]

Just adding the 3.2 patch

[karlcow]

Relevant spec
https://tools.ietf.org/html/rfc6265