Description

assignee = None
closed_at = None
created_at = <Date 2013-11-20.20:23:24.596>
labels = ['type-bug', '3.8', '3.9', '3.10', '3.7', 'docs']
title = 'SimpleCookie Generates Non-RFC6265-Compliant Cookies'
updated_at = <Date 2020-06-20.19:49:24.620>
user = 'https://bugs.python.org/pdbogen'

activity = <Date 2020-06-20.19:49:24.620>
actor = 'Ido Michael'
assignee = 'docs@python'
closed = False
closed_date = None
closer = None
components = ['Documentation']
creation = <Date 2013-11-20.20:23:24.596>
creator = 'pdbogen'
dependencies = []
files = []
hgrepos = []
issue_num = 19670
keywords = ['patch']
message_count = 5.0
messages = ['203529', '334409', '370760', '371086', '371959']
nosy_count = 6.0
nosy_names = ['taleinat', 'docs@python', 'martin.panter', 'serhiy.storchaka', 'pdbogen', 'Ido Michael']
pr_nums = ['21017']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue19670'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']

Activity

1. pdbogen commented on Nov 20, 2013

   

   pdbogenmannequin

   on Nov 20, 2013

   MannequinAuthor

   More actions

   SimpleCookie uses _quote to quote cookie values, which converts special characters to \OCTAL notation. This is not RFC6265 compliance, which requires- in part- that cookie values do not contain backslashes:

   cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
   cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
   ; US-ASCII characters excluding CTLs,
   ; whitespace DQUOTE, comma, semicolon,
   ; and backslash
2. pdbogen

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Nov 20, 2013
3. vadmium commented on Jan 27, 2019

   

   vadmium

   on Jan 27, 2019

   Member

   More actions

   I think the solution here is to document what “SimpleCookie.value_encode” really does: RFC 2109 quoted-string escaping. If you want to a generate RFC-6265-compliant Set-Cookie string, do not include non-compliant characters in the cookie value, and consider using BaseCookie rather than SimpleCookie, especially if your “morsel” values are enclosed in double quotes.
4. vadmium

   added

   docsDocumentation in the Doc dirDocumentation in the Doc dir

   on Jan 27, 2019
5. vadmium

   assigned

   docspython

   on Jan 27, 2019
6. serhiy-storchaka

   added

   3.7 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   3.10 (EOL)end of lifeend of life

   on May 31, 2020
7. idomic commented on Jun 5, 2020

   

   idomicmannequin

   on Jun 5, 2020

   Mannequin

   More actions

   I think it can be closed?
8. taleinat commented on Jun 9, 2020

   

   taleinat

   on Jun 9, 2020

   Contributor

   More actions

   It seems that the docs haven't been updated regarding this, so I don't think this should be closed. On the contrary, A PR adding a clarification to the docs would be most welcome.
9. taleinat

   removed

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Jun 9, 2020
10. idomic commented on Jun 20, 2020

    

    idomicmannequin

    on Jun 20, 2020

    Mannequin

    More actions

    Opened a PR:
    python/issues-test-cpython#21017

    The documentation in the internal functions was helpful.
    Should I also add it once decided on the format in here? Doc/library/http.cookies.rst:55
11. ezio-melotti

    transferred this issue fromon Apr 10, 2022
12. serhiy-storchaka

    added this to Cookies issues 🍪on May 20, 2022

Issue actions