This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Title: Issue parsing valid cookie
Type: Stage: resolved
Components: Versions: Python 2.7
Status: closed Resolution: duplicate
Dependencies: Superseder: cookies with square brackets in value
View: 22931
Assigned To: Nosy List: dlamotte, r.david.murray
Priority: normal Keywords:

Created on 2015-01-28 19:26 by dlamotte, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Messages (3)
msg234908 - (view) Author: Dan LaMotte (dlamotte) Date: 2015-01-28 19:26
I recently discovered that a valid cookie (by the RFC) is not parse-able by the Cookie library in python's standard library.

  import Cookie
  c = Cookie.SimpleCookie('key=[ab]cd[ef]')
  print c.keys() # yields []

When quoted, it works fine:

  c = Cookie.SimpleCookie('key="[ab]cd[ef]"')
  print c.keys() # yields ['key']

I noticed the issue after upgrading to Python 2.7.9 (was previously at 2.7.2).  The issue cropped up in our internal Django Web site when another internal site used a cookie in a similar format to the above and due to the sort order of the cookies, it appeared before the sessionid cookie we use with Django.  Effectively, parsing of the cookie header stops and the sessionid is never read which ... to Django ... means you are not logged in.  So, attempt to login, no errors, redirect to new page after successful login and you still appear not logged in.


cookie-value in
token in

cookie-pair = cookie-name "=" cookie-value
cookie-name = token

The code correctly disallows brackets [ and ] in cookie-name's, but ends up disallowing them in cookie-value's as well which is not RFC Compliant.

We noticed this issue in Chrome but not Firefox.  Our guess is that Firefox quotes its cookie-values which the code handles just fine.
msg234909 - (view) Author: R. David Murray (r.david.murray) * (Python committer) Date: 2015-01-28 19:42
This may be a duplicate of issue 22931.  If so please add your comments there and close this one.
msg234912 - (view) Author: Dan LaMotte (dlamotte) Date: 2015-01-28 20:17
Yes, this is a duplicate of that bug.  Sorry.
Date User Action Args
2022-04-11 14:58:12adminsetgithub: 67530
2015-01-28 20:23:56berker.peksagsetsuperseder: cookies with square brackets in value
resolution: duplicate
stage: resolved
2015-01-28 20:17:22dlamottesetstatus: open -> closed

messages: + msg234912
2015-01-28 19:42:36r.david.murraysetnosy: + r.david.murray
messages: + msg234909
2015-01-28 19:26:05dlamottecreate