Fix documentation/cookie handling in response.set_cookie() by digitalresistor · Pull Request #172 · Pylons/webob

digitalresistor · 2014-11-09T05:43:20Z

This updates response.set_cookie() with proper documentation, and refactors it so that it uses webob.cookies.make_cookie() instead of it's own implementation, code-reuse for the win!

However, this does break backwards compatibility because we no longer allow unicode cookie values, these were technically contra-spec in the first place, and may not have been accepted by all browsers.

We also change from key to name because cookies have names.

This fixes #166 and #171.

digitalresistor · 2014-11-10T08:11:41Z

This additionally fixes: #129

mmerickel · 2014-11-12T08:49:26Z

I'm definitely +1 on utilizing make_cookie here. However is make_cookie actually correct? In #171 you mention that it encodes things to latin1 but the code shows that it encodes things to ascii (which would fail on higher-order bytes).

digitalresistor · 2014-11-12T16:25:37Z

@mmerickel Seems I made a mistake when looking at the code, ASCII is correct, high-order bytes are NOT allowed in cookies. So make_cookie() and by extension Morsel() is correct.

Technically we should restrict the allowed characters even further to the allowed set as set in RFC6265:

0x21: !
0x23-2B: #$%&'()*+
0x2D-3A: -./0123456789: 
0x3C-5B: <=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[
0x5D-7E: ]^_`abcdefghijklmnopqrstuvwxyz{|}~

So that WebOb does not allow the creation of cookies that fall outside of that spec.

mmerickel · 2014-11-13T00:59:16Z

"this raise" grammar

Fixed. Squashed.

mmerickel · 2014-11-13T01:44:48Z

+1, LGTM

This is a nice cleanup of the cookie apis.

mcdonc · 2014-11-14T01:39:50Z

Can you say a few words about what RFC6265 allows here so folks don't need to look up the spec, and say under what circumstances a warning will be issued?

We should also push out this code in the form of an alpha release, if only to let people try it and tell us "hey I was successfully using WebOb to store cookies with high-order names/values and you broke me!"

Currently the API will just issue a RuntimeWarning, which hopefully means we don't break anyone, but give everyone time to update their code.

I will update this file with your suggestions for what RFC6265 allows, and I am all for doing an alpha release/beta release to make sure I didn't break anything... at least too terribly ;-)

mcdonc · 2014-11-14T01:57:45Z

This all looks reasonable to me; did confirm that the interpretation of RFC6265 that Bert had is more or less correct. As I mentioned above we should push this out in some sort of "major alpha" to see if it hurts anyone.

digitalresistor · 2014-11-14T07:49:45Z

@mcdonc

Information has been added about the cookie-octet allowed characters in docs/news.txt.

@mmerickel @mcdonc:

Thank you both for reviewing this :-)

The documentation for expires incorrectly states that expires can be a timedelta, let's add a test for that.

The documentation erroneously states that that expires can be a datetime.timedelta, this is incorrect, but since it has been documented as such, we should continue accepting it. Add the fact that it can be a datetime.datetime, and probably should be.

Start using the make_cookie call that is available in webob.cookies, this way we don't duplicate the same behavior. There are a couple of backwards compatible fixes: - If expires is set to a timedelta, and max_age is not set, we set max_age to expires a timedelta - expires can also be a datetime, however this was not documented. So if it is a datetime, we want to get a timedelta, by taking the existing expires value, and removing datetime.utcnow() from the value.

We need to document that max_age can be an integer, timedelta or None, and what that means. max_age takes precedence over an expires argument.

Unicode values in cookies are invalid.

The previous standard was the JSON serializer, however with upcoming changes that limit what characters are allowed in cookies, bare JSON no longer worked because it could return values that are invalid to be stored in cookies.

WebOb will now raise a ValueError if an attempt is made to set the cookie to an invalid value. According to RFC6265 a cookie-octet has a specific subset of allowed ASCII characters, and that subset does not change whether the value is DQUOT'ed or not. WebOb will still accept all other cookies, it just won't be able to create them.

We want to make sure we have at least one test for CookieProfile that fetches a cookie from our request object, and then verifies it returns the appropriate answer.

Someday we can get rid of this mess and just be strict about what we send, but until such a day we want to warn people that it is going to happen in the future.

This makes the warning more noticeable to people and will be less likely to be ignored.

Sets up the cookies._should_raise using a module setup/teardown functions instead of setting it at module scope per suggestions from Michael Merickel.

We want to provide people an easy to find resource on what is now going to be valid in a WebOb cookie.

digitalresistor · 2015-03-23T03:38:36Z

Superseded by #188

digitalresistor mentioned this pull request Nov 9, 2014

Set cookie incorrectly handles timedelta expires argument #166

Closed

mmerickel reviewed Nov 13, 2014
View reviewed changes

mcdonc reviewed Nov 14, 2014
View reviewed changes

digitalresistor added this to the Version 1.5 milestone Mar 23, 2015

digitalresistor added 17 commits March 22, 2015 21:36

Documentation states expires can be timedelta

0c2890c

The documentation for expires incorrectly states that expires can be a timedelta, let's add a test for that.

Cookies have names, not keys...

7cc8094

Update the documentation for response.set_cookie max_age

93ca34a

We need to document that max_age can be an integer, timedelta or None, and what that means. max_age takes precedence over an expires argument.

Change test_cookies() to not include unicode

2bf7746

Unicode values in cookies are invalid.

Verify unicode values raise an exception

b1486dc

Update news.txt with latest fixes/documentation

e14a4df

Update comments that had false information

f3ba7a8

Add new base64 serializer

f8379ef

Set new Base64Serializer as default on CookieProfile

e5726bf

The previous standard was the JSON serializer, however with upcoming changes that limit what characters are allowed in cookies, bare JSON no longer worked because it could return values that are invalid to be stored in cookies.

Document cookie name requirements explicitly

3bf0ca5

Import assert_raises

6d61105

Remove utf-8 strings from testing

e5bd763

Update test strings to match what is now returned

e25cd58

Verify decode of old cookies, and failure of encoding same cookies

f3c1175

digitalresistor added 10 commits March 22, 2015 21:36

Remove useless test

a671bef

Add new test for CookieProfile

da7e8a4

We want to make sure we have at least one test for CookieProfile that fetches a cookie from our request object, and then verifies it returns the appropriate answer.

Until such a time that we can deprecate this, warn

6804b13

Someday we can get rid of this mess and just be strict about what we send, but until such a day we want to warn people that it is going to happen in the future.

Don't calculate the same result twice

664041d

Update test to use eq_ instead of assert

933b6c5

Use RuntimeWarning instead of DeprecationWarning

0e56c53

This makes the warning more noticeable to people and will be less likely to be ignored.

Update news about Morsel/set_cookie changes

966dd64

Re-instate utf-8 cookie values (b/w)

62cf2d9

Add setup/teardown module functions

5d0e7b9

Sets up the cookies._should_raise using a module setup/teardown functions instead of setting it at module scope per suggestions from Michael Merickel.

Add better/more information about RFC6265 cookie-octet

cebf4b8

We want to provide people an easy to find resource on what is now going to be valid in a WebOb cookie.

digitalresistor mentioned this pull request Mar 23, 2015

Fix.cookie handling #188

Merged

digitalresistor closed this Mar 23, 2015

pyup-bot mentioned this pull request Jan 26, 2018

Update webob to 1.7.4 DemocracyClub/yournextrepresentative#407

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix documentation/cookie handling in response.set_cookie()#172

Fix documentation/cookie handling in response.set_cookie()#172
digitalresistor wants to merge 27 commits into
Pylons:masterfrom
digitalresistor:fix.cookie_date_handling

digitalresistor commented Nov 9, 2014

Uh oh!

digitalresistor commented Nov 10, 2014

Uh oh!

mmerickel commented Nov 12, 2014

Uh oh!

digitalresistor commented Nov 12, 2014

Uh oh!

mmerickel Nov 13, 2014

Uh oh!

digitalresistor Nov 13, 2014

Uh oh!

mmerickel commented Nov 13, 2014

Uh oh!

mcdonc Nov 14, 2014

Uh oh!

mcdonc Nov 14, 2014

Uh oh!

digitalresistor Nov 14, 2014

Uh oh!

mcdonc commented Nov 14, 2014

Uh oh!

digitalresistor commented Nov 14, 2014

Uh oh!

digitalresistor commented Mar 23, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

digitalresistor commented Nov 9, 2014

Uh oh!

digitalresistor commented Nov 10, 2014

Uh oh!

mmerickel commented Nov 12, 2014

Uh oh!

digitalresistor commented Nov 12, 2014

Uh oh!

mmerickel Nov 13, 2014

Choose a reason for hiding this comment

Uh oh!

digitalresistor Nov 13, 2014

Choose a reason for hiding this comment

Uh oh!

mmerickel commented Nov 13, 2014

Uh oh!

mcdonc Nov 14, 2014

Choose a reason for hiding this comment

Uh oh!

mcdonc Nov 14, 2014

Choose a reason for hiding this comment

Uh oh!

digitalresistor Nov 14, 2014

Choose a reason for hiding this comment

Uh oh!

mcdonc commented Nov 14, 2014

Uh oh!

digitalresistor commented Nov 14, 2014

Uh oh!

digitalresistor commented Mar 23, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants