Fix cookie handling #6636

bratao · 2022-02-25T17:20:30Z

What do these changes do?

There is an error in cookie handling that override the existing cookie if the path is different. This is a huge bug in aiohttp, as it makes requests to some sites impossible to work.

The RFC 6265 is clear on this point (https://datatracker.ietf.org/doc/html/rfc6265) , for example:

Finally, to remove a cookie, the server returns a Set-Cookie header
   with an expiration date in the past.  The server will be successful
   in removing the cookie only **if the Path and the Domain attribute** in
   the Set-Cookie header match the values used when the cookie was
   created.

Actually aiohttp only consider domain and name. Pull request #3627 tried to fix this, but the code has been updated vastly since then.

Are there changes in behavior for the user?

No

Related issue number

Checklist

I think the code is well written
Unit tests for the changes exist
Documentation reflects the changes
If you provide code modification, please add yourself to CONTRIBUTORS.txt
- The format is <Name> <Surname>.
- Please keep alphabetical order, the file is sorted by names.
Add a new news fragment into the CHANGES folder
- name it <issue_id>.<type> for example (588.bugfix)
- if you don't have an issue_id change it to the pr id after creating the pr
- ensure type is one of the following:
  - .feature: Signifying a new feature.
  - .bugfix: Signifying a bug fix.
  - .doc: Signifying a documentation improvement.
  - .removal: Signifying a deprecation or removal of public API.
  - .misc: A ticket has been closed, but it is not of interest to users.
- Make sure to use full sentences with correct case and punctuation, for example: "Fix issue with non-ascii contents in doctest text files."

Bumps [typing-extensions](https://github.com/python/typing) from 3.7.4.3 to 4.0.0. - [Release notes](https://github.com/python/typing/releases) - [Changelog](https://github.com/python/typing/blob/master/typing_extensions/CHANGELOG) - [Commits](python/typing@3.7.4.3...4.0.0) --- updated-dependencies: - dependency-name: typing-extensions dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This reverts commit 8b15cce.

…ibs#6313) (aio-libs#6317) Since aio-libs#4732, it's wrong to says that `setUpAsync()` and `tearDownAsync()` do nothing and can be overridden without calling `super.setUpAsync()` and `super.tearDownAsync()`. (cherry picked from commit d149eff) Co-authored-by: Hoel IRIS <[email protected]>

@meetmangukiya

PR aio-libs#4615 by @meetmangukiya Fixes aio-libs#4663 Co-authored-by: Sviatoslav Sydorenko <[email protected]>

* Bump cryptography from 35.0.0 to 36.0.0 Bumps [cryptography](https://github.com/pyca/cryptography) from 35.0.0 to 36.0.0. - [Release notes](https://github.com/pyca/cryptography/releases) - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@35.0.0...36.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Bumps [actions/cache](https://github.com/actions/cache) from 2.1.6 to 2.1.7. - [Release notes](https://github.com/actions/cache/releases) - [Commits](actions/cache@v2.1.6...v2.1.7) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [python-on-whales](https://github.com/gabrieldemarmiesse/python-on-whales) from 0.31.0 to 0.32.0. - [Release notes](https://github.com/gabrieldemarmiesse/python-on-whales/releases) - [Commits](gabrieldemarmiesse/python-on-whales@v0.31.0...v0.32.0) --- updated-dependencies: - dependency-name: python-on-whales dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…uring app (aio-libs#6341) Co-authored-by: Andrew Svetlov <[email protected]> Co-authored-by: Sam Bull <[email protected]> Co-authored-by: Sviatoslav Sydorenko <[email protected]> Co-authored-by: sha016 <[email protected]>

Bumps [charset-normalizer](https://github.com/ousret/charset_normalizer) from 2.0.7 to 2.0.8. - [Release notes](https://github.com/ousret/charset_normalizer/releases) - [Changelog](https://github.com/Ousret/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@2.0.7...2.0.8) --- updated-dependencies: - dependency-name: charset-normalizer dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [sphinx](https://github.com/sphinx-doc/sphinx) from 4.3.0 to 4.3.1. - [Release notes](https://github.com/sphinx-doc/sphinx/releases) - [Changelog](https://github.com/sphinx-doc/sphinx/blob/4.x/CHANGES) - [Commits](sphinx-doc/sphinx@v4.3.0...v4.3.1) --- updated-dependencies: - dependency-name: sphinx dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [coverage](https://github.com/nedbat/coveragepy) from 6.1.2 to 6.2. - [Release notes](https://github.com/nedbat/coveragepy/releases) - [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst) - [Commits](nedbat/coveragepy@6.1.2...6.2) --- updated-dependencies: - dependency-name: coverage dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) from 2.2.2 to 2.3.0. - [Release notes](https://github.com/pypa/cibuildwheel/releases) - [Changelog](https://github.com/pypa/cibuildwheel/blob/main/docs/changelog.md) - [Commits](pypa/cibuildwheel@v2.2.2...v2.3.0) --- updated-dependencies: - dependency-name: pypa/cibuildwheel dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 2.15.0 to 2.16.0. - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/master/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v2.15.0...v2.16.0) --- updated-dependencies: - dependency-name: pre-commit dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [aio-libs/create-release](https://github.com/aio-libs/create-release) from 1.2.3 to 1.3.1. - [Release notes](https://github.com/aio-libs/create-release/releases) - [Commits](aio-libs/create-release@v1.2.3...v1.3.1) --- updated-dependencies: - dependency-name: aio-libs/create-release dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…on failure in GHA (aio-libs#6370) Co-authored-by: Sviatoslav Sydorenko <[email protected]>

…orts in the project (aio-libs#6376) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Sviatoslav Sydorenko <[email protected]>

Co-authored-by: Andrew Svetlov <[email protected]> (cherry picked from commit eef86e9) Co-authored-by: Se̐rhii Khaly̐mon <[email protected]>

…-release (aio-libs#6381) Co-authored-by: Andrew Svetlov <[email protected]> Co-authored-by: Sviatoslav Sydorenko <[email protected]>

It allows to run CI tests after committing changes

Bumps [sphinxcontrib-spelling](https://github.com/sphinx-contrib/spelling) from 7.2.1 to 7.3.0. - [Release notes](https://github.com/sphinx-contrib/spelling/releases) - [Commits](sphinx-contrib/spelling@7.2.1...7.3.0) --- updated-dependencies: - dependency-name: sphinxcontrib-spelling dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [charset-normalizer](https://github.com/ousret/charset_normalizer) from 2.0.8 to 2.0.9. - [Release notes](https://github.com/ousret/charset_normalizer/releases) - [Changelog](https://github.com/Ousret/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@2.0.8...2.0.9) --- updated-dependencies: - dependency-name: charset-normalizer dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [sphinxcontrib-blockdiag](https://github.com/blockdiag/sphinxcontrib-blockdiag) from 2.0.0 to 3.0.0. - [Release notes](https://github.com/blockdiag/sphinxcontrib-blockdiag/releases) - [Commits](blockdiag/sphinxcontrib-blockdiag@2.0.0...3.0.0) --- updated-dependencies: - dependency-name: sphinxcontrib-blockdiag dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

… binary distributions (aio-libs#6402) Co-authored-by: Ben Beasley <[email protected]>

…#6409) Co-authored-by: Sviatoslav Sydorenko <[email protected]>

Co-authored-by: TiunovNN <[email protected]>

…libs#6446) (aio-libs#6451) Co-authored-by: Sviatoslav Sydorenko <[email protected]>

…n cchardet (aio-libs#6478) (cherry picked from commit 4df4f13) Co-authored-by: lrjball <[email protected]>

(cherry picked from commit 5d70b8e) Co-authored-by: Sam Bull <[email protected]>

…6503) * Add aiohttp-catcher to 3rd party libraries * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> (cherry picked from commit 240d9c4) Co-authored-by: Yuval <[email protected]>

for more information, see https://pre-commit.ci

Dreamsorcerer

Afraid you'll need to rebase or something to merge into master branch. From there we can backport to 3.9 (not sure we should include this in 3.8).

Dreamsorcerer · 2022-02-27T18:55:57Z

tests/test_cookiejar.py

+        jar_filtred = jar.filter_cookies(URL("http://pathtest.com/"))
+        self.assertEqual(len(jar_filtred), 1)
+        self.assertEqual(jar_filtred["path-cookie"].value, "zero")
+
+        jar_filtred = jar.filter_cookies(URL("http://pathtest.com/one"))
+        self.assertEqual(len(jar_filtred), 1)
+        self.assertEqual(jar_filtred["path-cookie"].value, "one")


filtred -> filtered

for more information, see https://pre-commit.ci

asvetlov and others added 30 commits November 15, 2021 10:58

Suppress deprecation about old version class used by gunicorn

09f868e

Revert "Bump typing-extensions from 3.7.4.3 to 4.0.0 (aio-libs#6311)"

30bdb25

This reverts commit 8b15cce.

Support registering OPTIONS HTTP method handlers via RouteTableDef

7a647d5

PR aio-libs#4615 by @meetmangukiya Fixes aio-libs#4663 Co-authored-by: Sviatoslav Sydorenko <[email protected]>

Update constraints

f1815e6

Update constraints

042ccb4

Recompile deps

6d7fe83

Pin requirements

4bfb90f

[PR aio-libs#6369/13b6b4dd backport][3.8] Fix setting branch protecti…

1dd0f3a

…on failure in GHA (aio-libs#6370) Co-authored-by: Sviatoslav Sydorenko <[email protected]>

[PR aio-libs#6375/eccd9099 backport][3.8] Add a test for circular imp…

ff0e644

…orts in the project (aio-libs#6376) Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Sviatoslav Sydorenko <[email protected]>

Fix example in client_quickstart.rst (aio-libs#6363) (aio-libs#6364)

ea5d8ee

Co-authored-by: Andrew Svetlov <[email protected]> (cherry picked from commit eef86e9) Co-authored-by: Se̐rhii Khaly̐mon <[email protected]>

[PR aio-libs#6380/674948f5 backport][3.8] Bump proxy.py to v2.4.0 pre…

1803415

…-release (aio-libs#6381) Co-authored-by: Andrew Svetlov <[email protected]> Co-authored-by: Sviatoslav Sydorenko <[email protected]>

Use non-default token for post-dependabot workflow

d853ce3

It allows to run CI tests after committing changes

Install pip-tools for dependabot post-update workflow

23967c4

Recompile constraints

d0c6c2a

Downgrade blockdiag to 2.0.0

f249663

asvetlov and others added 11 commits December 7, 2021 00:53

Fix Python 3.11 alpha incompatibilities (aio-libs#6396)

1a4fbc8

[PR aio-libs#6400/e1ed247d backport][3.8] Do not install C sources in…

83e9b8a

… binary distributions (aio-libs#6402) Co-authored-by: Ben Beasley <[email protected]>

Support absolute-form and authority-form URLs by web server (aio-libs…

535c58e

…#6409) Co-authored-by: Sviatoslav Sydorenko <[email protected]>

Convert type comments to type annotations (aio-libs#6412)

3001f96

Edited the web.run_app declaration. (aio-libs#6401) (aio-libs#6404)

98ae7f3

Co-authored-by: TiunovNN <[email protected]>

Regression test for handling unsupported Upgrade requests (issue aio-…

a60e8a5

…libs#6446) (aio-libs#6451) Co-authored-by: Sviatoslav Sydorenko <[email protected]>

[PR aio-libs#6477/4df4f133 backport][3.8] Typo in docs, should mentio…

2c568d0

…n cchardet (aio-libs#6478) (cherry picked from commit 4df4f13) Co-authored-by: lrjball <[email protected]>

Switch to cleanup_ctx in example (aio-libs#6491) (aio-libs#6492)

c9516b8

(cherry picked from commit 5d70b8e) Co-authored-by: Sam Bull <[email protected]>

Fix cookie handling

37e93a6

Fix cookie handling

39152e4

bratao requested review from webknjaz and asvetlov as code owners February 25, 2022 17:20

pre-commit-ci bot and others added 3 commits February 25, 2022 17:21

[pre-commit.ci] auto fixes from pre-commit.com hooks

0457307

for more information, see https://pre-commit.ci

Fix cookie handling

9f287b9

Merge remote-tracking branch 'origin/3.8' into 3.8

28f5930

psf-chronographer bot added the bot:chronographer:provided There is a change note present in this PR label Feb 25, 2022

Dreamsorcerer requested changes Feb 27, 2022

View reviewed changes

Bruno Cabral and others added 2 commits February 27, 2022 20:15

Fix cookie handling

0302649

[pre-commit.ci] auto fixes from pre-commit.com hooks

5aebe40

for more information, see https://pre-commit.ci

bratao changed the base branch from 3.8 to master February 28, 2022 19:21

bratao closed this Feb 28, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix cookie handling #6636

Fix cookie handling #6636

bratao commented Feb 25, 2022 •

edited

Loading

Dreamsorcerer left a comment

Dreamsorcerer Feb 27, 2022

Fix cookie handling #6636

Fix cookie handling #6636

Conversation

bratao commented Feb 25, 2022 • edited Loading

What do these changes do?

Are there changes in behavior for the user?

Related issue number

Checklist

Dreamsorcerer left a comment

Choose a reason for hiding this comment

Dreamsorcerer Feb 27, 2022

Choose a reason for hiding this comment

bratao commented Feb 25, 2022 •

edited

Loading