4 people ac1d49f4fb [3.14] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) (#161580) ...

gh-161569: Check cookie policy before deleting expired cookies in `http.cookiejar` (GH-161570)

gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar

An expired Set-Cookie header was allowed to delete a stored cookie using
the Domain and Path attributes taken verbatim from the header, before
CookiePolicy.set_ok() was consulted. A response from one host could
therefore delete cookies belonging to any other domain in a shared jar.

The policy is now consulted before an expired cookie may delete an
existing one, as required by RFC 6265 section 5.3.
(cherry picked from commit 8eb3d2c1c4)

Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>

2026-11-07 22:18:11 +00:00

..

__init__.py

…

client.py

[3.14] Replace placeholder text in the http.client module docstring (GH-121490) (#160970)

2026-10-30 15:14:37 +00:00

cookiejar.py

[3.14] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) (#161580)

2026-11-07 22:18:11 +00:00

cookies.py

[3.14] gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157)

2026-06-05 09:50:14 +01:00

server.py

[3.14] gh-54930: Send a status line in error responses to malformed request lines (GH-152980) (GH-153093)

2026-07-05 11:15:38 +00:00