This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author spookylukey
Recipients spookylukey
Date 2010-09-10.16:50:07
SpamBayes Score 0.000241317
Marked as misclassified No
Message-id <>
In developing Django, we found that some browsers don't treat commas and semi-colons in cookie values (i.e. the Set-Cookie header) the way that RFC 2109 says they should. (Safari splits the header on a comma followed by space, Internet Explorer splits on semi-colons - both irrespective of any 'quoting').

The result is that if you use SimpleCookie to create Set-Cookie headers, where the cookie value contains a comma or semi-colon, you can get all kinds of breakage. 

In the end, we realised that the RFCs are kind of irrelevant, and we have to look at what browsers actually do.  So, it would be much more useful if semi-colons and commas were escaped the way that other characters are by SimpleCookie.

Our discussion/findings are here:

The patch to (Python 2.X) or http/ (Python 3.X) is simple and follows. I'm assuming that this applies to Python 3.2 and 3.3, but I haven't checked.
Date User Action Args
2010-09-10 16:50:10spookylukeysetrecipients: + spookylukey
2010-09-10 16:50:10spookylukeysetmessageid: <>
2010-09-10 16:50:08spookylukeylinkissue9824 messages
2010-09-10 16:50:07spookylukeycreate