This patch implements part of bug 1372650.

Sometimes a web client will send 2 instances of the same name:

Cookie: mycookie=foo; mycookie=bar

The specs listed here:

http://wp.netscape.com/newsref/std/cookie_spec.html

state that the first one is the one that should be used. The other 
cookies listed are the inherited ones from paths that a prefix of the 
current URL. When this is parsed by the Cookie module, mycookie gets 
set to bar when it should be foo.

This patch changes Cookie.py to only use the first instance of duplicate 
cookies when parsing cookie strings.

That link is misleading and just confuses you. :) Instead read John J. Lee's great explanation at the referenced bug report. I have tested the patch and it works as expected. Without the patch:

>>> c = SimpleCookie('foo=33;foo=34')
>>> print c
Set-Cookie: foo=34

With the patch:

>>> c = SimpleCookie('foo=33;foo=34')
>>> print c
Set-Cookie: foo=33

There should be a unit test though and something in the documentation. The keys dict should be a set instead.

See discussion in issue 1372650.

Even if the patch is still valid there are still no doc or unit test changes.

Attached is a patch with Viraj's original fix except using a set instead of a dict as suggested by Björn. This patch also includes a test case and a note in the docs about this behavior.

Since Cookie has been moved and the code has been cleaned up somewhat between 2.7 and 3.2 I'm attaching patches for both branches.

Of course, a decision still needs to be made whether or not this should be applied; the behavior is more correct now, but I don't know if it is worth potentially breaking applications that have come to expect the old behavior. There doesn't seem to be a consensus in #1372650 but I thought having a complete patch would be a good thing regardless.

Just adding the 3.2 patch

Relevant spec
https://tools.ietf.org/html/rfc6265

This patch should really be included.

As carl already mentioned, the relevant spec is RFC 6265, see section 5.4.2: "The user agent SHOULD sort the cookie-list in the following order: Cookies with longer paths are listed before cookies with shorter paths. Among cookies that have equal-length path fields, cookies with earlier creation-times are listed before cookies with later creation-times."

Currently, if the cookies are loaded with cookies.load(env['HTTP_COOKIE']) as most web frameworks do, then the cookies will be populated with the least specific or oldest values if there are duplicates. This is really bad.