GeezerVison

Original file line number	Diff line number	Diff line change
Expand Up		@@ -137,11 +137,17 @@ Morsel Objects
		* ``secure``
		* ``version``
		* ``httponly``
		* ``samesite``

		The attribute :attr:`httponly` specifies that the cookie is only transferred
		in HTTP requests, and is not accessible through JavaScript. This is intended
		to mitigate some forms of cross-site scripting.

		The attribute :attr:`samesite` specifies that browser is not allowed to send the
Comment thread Outdated timgraham Feb 22, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. I think "The samesite attribute" is better English (not sure if the pattern from the previous paragraph is commonly used). "the browser" (add "the") Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. Mariatta reacted with thumbs up emoji All reactions 👍 1 reaction
		cookie along with cross-site requests. This help to mitigate CSRF attacks. Valid
Comment thread Outdated timgraham Feb 22, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. This helps Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. Mariatta reacted with thumbs up emoji All reactions 👍 1 reaction
		values for this attribute are "Strict" and "Lax".
Comment thread Outdated timgraham Feb 22, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. What are the meaning of these values? Are invalid values rejected? I don't see any code/tests for that. Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions akash0x53 Feb 25, 2017 Copy link Copy Markdown Author There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Explaining the values would be out of scope of the Python documentation. I think invalid values should be accepted, after all its browser's job to discard invalid values. Suppose, in future they proposed or added another value for `SameSite` then we need to make space for that too. By the way i'm not sure about this, let the member decide. Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions berkerpeksag Feb 27, 2017 Copy link Copy Markdown Member There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Tim is correct that we need to add a test for invalid values. However, we need to decide on what we should do with invalid values first. I don't have time to do a research at the moment, but just a note that Firefox doesn't implement SameSite support yet: https://bugzilla.mozilla.org/show_bug.cgi?id=795346 Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions akash0x53 Feb 27, 2017 Copy link Copy Markdown Author There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. You're right. However, chrome implemented SamSite. Right now only Chrome implemented this. https://bugs.chromium.org/p/chromium/issues/detail?id=459154 I checked the test cases they wrote for the same, i didn't find test cases for invalid values. https://chromium.googlesource.com/chromium/src/+/f71d0bde417518f99f977a0ecbf480b375cf49ca/net/cookies/canonical_cookie_unittest.cc#86 I messed with this branch :( Should I open new PR? Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions timgraham Feb 27, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. You should be able to fix the branch by rebasing and force pushing. Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions

Comment thread Outdated Mariatta Feb 21, 2017 Copy link Copy Markdown Member There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Please add below this line: .. versionchanged:: 3.7 Added support for :attr:`samesite` attribute. Thanks @alex for the clarification about this :) Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions

		The keys are case-insensitive and their default value is ``''``.

		.. versionchanged:: 3.5
Expand All		@@ -153,6 +159,9 @@ Morsel Objects
		:attr:`~Morsel.coded_value` are read-only. Use :meth:`~Morsel.set` for
		setting them.

		.. versionchanged:: 3.7
		Added support for :attr:`samesite` attribute.
Comment thread Outdated timgraham Feb 22, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. for the Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. Mariatta reacted with thumbs up emoji All reactions 👍 1 reaction


		.. attribute:: Morsel.value

Expand Down

1 change: 1 addition & 0 deletions 1 Lib/http/cookies.py

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -281,6 +281,7 @@ class Morsel(dict):
		"secure" : "Secure",
		"httponly" : "HttpOnly",
		"version" : "Version",
		"samesite" : "SameSite",
		}

		_flags = {'secure', 'httponly'}
Expand Down

9 changes: 9 additions & 0 deletions 9 Lib/test/test_http_cookies.py

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -121,6 +121,15 @@ def test_set_secure_httponly_attrs(self):
		self.assertEqual(C.output(),
		'Set-Cookie: Customer="WILE_E_COYOTE"; HttpOnly; Secure')

		def test_samesite_attrs(self):
		samesite_values = ("Strict", "Lax")
Comment thread Outdated timgraham Feb 22, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Use single quotes for consistency? Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. akash0x53 and Mariatta reacted with thumbs up emoji All reactions 👍 2 reactions
		for val in samesite_values:
		with self.subTest(val=val):
		C = cookies.SimpleCookie('Customer="WILE_E_COYOTE"')
		C['Customer']['samesite'] = val
		self.assertEqual(C.output(),
		'Set-Cookie: Customer="WILE_E_COYOTE"; SameSite=%s' % val)
Comment thread Outdated timgraham Feb 22, 2017 Copy link Copy Markdown Contributor There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. indentation missing Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions akash0x53 Feb 25, 2017 Copy link Copy Markdown Author There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Negative. It just an illusion i guess. Perfectly showing in my vim. Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions berkerpeksag Feb 27, 2017 Copy link Copy Markdown Member There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. What Tim meant was that the second argument needs to be indented, like: self.assertEqual(C.output(), 'Set-Cookie: Customer="WILE_E_COYOTE"; SameSite=%s' % val) or even better: expected = f'Set-Cookie: Customer="WILE_E_COYOTE"; SameSite={val}' self.assertEqual(C.output(), expected) Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions

		def test_secure_httponly_false_if_not_present(self):
		C = cookies.SimpleCookie()
		C.load('eggs=scrambled; Path=/bacon')
Expand Down

1 change: 1 addition & 0 deletions 1 Misc/ACKS

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -1396,6 +1396,7 @@ Varun Sharma
		Daniel Shaulov
		Vlad Shcherbina
		Justin Sheehy
		Akash Shende
		Charlie Shepherd
		Bruce Sherwood
		Alexander Shigin
Expand Down

2 changes: 2 additions & 0 deletions 2 Misc/NEWS

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -263,6 +263,8 @@ Library
		- Issue #16285: urrlib.parse.quote is now based on RFC 3986 and hence includes
		'~' in the set of characters that is not quoted by default. Patch by
		Christian Theune and Ratnadeep Debnath.
		- bpo-29613: http.cookies.Morsel now supports SameSite cookies.
		Patch by Akash Shende.

		- bpo-29532: Altering a kwarg dictionary passed to functools.partial()
		no longer affects a partial object after creation.
Expand Down

Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

bpo-29613: Added support for SameSite cookies #214

Uh oh!

bpo-29613: Added support for SameSite cookies #214

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!