Skip to content

RFC 2965 BaseCookie does not support "$Port" #44019

Open
Open
RFC 2965 BaseCookie does not support "$Port"#44019
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-featureA feature request or enhancement

Description

@aagaande
aagaande
mannequin
opened on Sep 24, 2006
BPO 1564508
Nosy @devdanzin, @vadmium

Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2006-09-24.13:05:52.000>
labels = ['type-feature', 'library']
title = 'RFC 2965 BaseCookie does not support "$Port"'
updated_at = <Date 2019-04-25.05:27:37.754>
user = 'https://bugs.python.org/aagaande'

bugs.python.org fields:

activity = <Date 2019-04-25.05:27:37.754>
actor = 'martin.panter'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2006-09-24.13:05:52.000>
creator = 'aagaande'
dependencies = []
files = []
hgrepos = []
issue_num = 1564508
keywords = []
message_count = 7.0
messages = ['29968', '29969', '81843', '88457', '88458', '114825', '340823']
nosy_count = 5.0
nosy_names = ['jjlee', 'aagaande', 'ajaksu2', 'benanhalt', 'martin.panter']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue1564508'
versions = ['Python 3.2']

Activity

  1. aagaande commented on Sep 24, 2006

    @aagaande
    aagaandemannequin
    on Sep 24, 2006
    MannequinAuthor

    Sending a cookie containing $Port to python's Cookie.py
    causes this exception:

    File "/usr/lib64/python2.4/Cookie.py", line 621, in load
    self.__ParseString(rawdata)
    File "/usr/lib64/python2.4/Cookie.py", line 646, in
    __ParseString
    M[ K[1:] ] = V
    File "/usr/lib64/python2.4/Cookie.py", line 437, in
    __setitem__
    raise CookieError("Invalid Attribute %s" % K)
    CookieError: Invalid Attribute port

    For RFC2965 compatibility more keys has to be added to
    the Morsel class in the same file.

  2. aagaande
    added
    stdlibStandard Library Python modules in the Lib/ directory
    on Sep 24, 2006

  3. jjlee commented on Mar 14, 2007

    @jjlee
    jjleemannequin
    on Mar 14, 2007
    Mannequin

    Why do you want RFC 2965 compatibility?

    I'm not trolling; RFC 2965 is dead as an internet protocol (except as a basis for implementing the older cookie protocols, as RFC 2965 + compatibility hacks -- but $Port is not relevant in that case). The authors of the RFC gave up on an effort to publish errata to the RFC, due to the complexities and the lack of interest from the internet at large.

    AFAIK, $Port is not implemented by browsers (except for maybe Opera and lynx, IIRC). It just never caught on.

    See also http://python.org/sf/1638033

  4. devdanzin commented on Feb 13, 2009

    @devdanzin
    devdanzinmannequin
    on Feb 13, 2009
    Mannequin

    Does anybody else need this one or should it be closed?

  5. devdanzin
    changed the title [-]BaseCookie does not support "$Port"[/-] [+]RFC 2965 BaseCookie does not support "$Port"[/+] on Feb 13, 2009
  6. devdanzin
    added
    type-featureA feature request or enhancement
    on Feb 13, 2009
  7. devdanzin
    changed the title [-]BaseCookie does not support "$Port"[/-] [+]RFC 2965 BaseCookie does not support "$Port"[/+] on Feb 13, 2009
  8. devdanzin
    added
    type-featureA feature request or enhancement
    on Feb 13, 2009

  9. benanhalt commented on May 28, 2009

    @benanhalt
    benanhaltmannequin
    on May 28, 2009
    Mannequin

    Actually, I was just bit by this. In fact, RFC 2965 prohibits clients
    from sending $Port if the port attribute was not included in the
    Set-Cookie header. But, it turns out that the mono System.Net library
    (at least) will add the attribute any time the URI includes a
    non-default port number. See http://go-mono.com/forums/#nabble-f1367 I
    think this is technically their bug, but it might be nice to have
    something like a non-strict mode in Cookie.py that would ignore
    unexpected attributes for handling cases like this.

  10. benanhalt commented on May 28, 2009

    @benanhalt
    benanhaltmannequin
    on May 28, 2009
    Mannequin

    Grrr, the link in my last comment should have been
    http://www.nabble.com/System.Net.CookieContainer-adding-inappropriate-%24Port-attribute-to-cookies--td23752882ef1367.html

    Yuck.

  11. BreamoreBoy commented on Aug 24, 2010

    @BreamoreBoy
    BreamoreBoymannequin
    on Aug 24, 2010
    Mannequin

    This won't go anywhere unless someone provides a patch.

  12. vadmium commented on Apr 25, 2019

    @vadmium
    vadmium
    on Apr 25, 2019
    Member

    The original report comes from <https://code.djangoproject.com/ticket/2806\>. Anders was trying to parse a HTTP request Cookie field, something like:

    BaseCookie('sessionid=a2be2e7debe71af8d88d350c4d14d768;$Path=/;$Domain=192.168.0.2;$Port="8000"')

    The problem is that Cookie.py assumes names beginning with a dollar sign ($) are reserved attributes of a previous cookie-pair, rather than arbitrary cookie names. It is obvious that this was intended to support RFC 2965, although it is not documented. The module has a hard-coded list of reserved attribute names, and Port is not one of them.

    IMO it would be better to treat (unknown) reserved attributes such as $Port as ordinary cookie names, and start a new “morsel”. Ignoring them would also be a better option than rejecting the whole cookie field. The dollar sign is valid for a cookie name (token) according to RFC 2109, RFC 6265, and the Netscape specification.

  13. ezio-melotti
    transferred this issue fromon Apr 10, 2022
  14. serhiy-storchaka
    added this to Cookies issues 🍪on May 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-featureA feature request or enhancement

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions