4 people 4e9d037f1c [3.15] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) (#161579) ...

gh-161569: Check cookie policy before deleting expired cookies in `http.cookiejar` (GH-161570)

gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar

An expired Set-Cookie header was allowed to delete a stored cookie using
the Domain and Path attributes taken verbatim from the header, before
CookiePolicy.set_ok() was consulted. A response from one host could
therefore delete cookies belonging to any other domain in a shared jar.

The policy is now consulted before an expired cookie may delete an
existing one, as required by RFC 6265 section 5.3.
(cherry picked from commit 8eb3d2c1c4)

Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>

2026-11-07 23:56:34 +02:00

..

__init__.py

…

client.py

[3.15] Replace placeholder text in the http.client module docstring (GH-121490) (#160969)

2026-10-30 15:06:47 +00:00

cookiejar.py

[3.15] gh-161569: Check cookie policy before deleting expired cookies in http.cookiejar (GH-161570) (#161579)

2026-11-07 23:56:34 +02:00

cookies.py

[3.15] gh-149144: Use decodeURIComponent() for UTF-8 support in js_output() (GH-149157) (GH-149846)

2026-05-15 00:38:11 +02:00

server.py

[3.15] gh-54930: Send a status line in error responses to malformed request lines (GH-152980) (GH-153092)

2026-07-05 11:22:09 +00:00