Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cookie parsing should be more permissive #3

Open
demianbrecht opened this issue Jun 12, 2015 · 0 comments
Open

Cookie parsing should be more permissive #3

demianbrecht opened this issue Jun 12, 2015 · 0 comments
Labels

Comments

@demianbrecht
Copy link
Owner

As found in #22931, if an invalid cookie value is found while parsing, the rest of the cookie is silently ignored. The expected behavior is undefined in RFC 6265, but does state that if unexpected values are encountered that user agents MAY ignore an entire set-cookie string (not just a subsection of it). Given that, invalid cookie portions should likely be handled by either:

  1. Ignore the cookie string in its entirety and log an error message, or
  2. Ignore invalid cookie-pairs but still parse the rest of the string

The latter would likely be the best path (Postel's law and all)

See: http://bugs.python.org/issue22983

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant