Client strips preceding dot in response.cookies values when cookie is set with preceding dot

[juraseg]

Long story short

I'm to set domain for cookies with preceding dot, for example ".example.com". On server I specify domain as ".example.com" and it sends proper headers.

I use aiohttp server, so I write tests using plugin for pytest. When testing I found that preceding dot is stripped from cookie domain when you check it using `response.cookies[<cookie_name>].domain. I've tried the same using aiohttp client and found that it has the same issue.

The leading dot in browser allows all subdomains to access cookie, while without it subdomain can't access cookies. This was found by testing browsers, despite what is said here - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie

Expected behaviour

Cookies in response cookie to not strip leading dot from domain name.

Actual behaviour

Preceding dots are striped from domain names in response.cookies.

Steps to reproduce

Test code bellow.
Server:

from aiohttp import web


async def handle(request):
    response = web.json_response({})
    response.set_cookie('my_cookie', 'value', domain='.example.com')
    print(response.cookies)

    return response

app = web.Application()
app.add_routes([web.get('/', handle)])

web.run_app(app)

When receives request it outputs:

Set-Cookie: my_cookie=value; Domain=.example.com; Path=/

Client:

import aiohttp
import asyncio

async def main():
    async with aiohttp.ClientSession() as session:
        result = await session.get('http://localhost:8080/', headers={'Origin': 'subdomain.example.com'})
        for c in result.cookies:
            print(f'{c}={result.cookies[c]}')
        print(result.headers)

loop = asyncio.get_event_loop()
loop.run_until_complete(main())

When run it outputs:

my_cookie=Set-Cookie: my_cookie=value; Domain=example.com; Path=/
<CIMultiDictProxy('Content-Type': 'application/json; charset=utf-8', 'Content-Length': '2', 'Set-Cookie': 'my_cookie=value; Domain=.example.com; Path=/', 'Date': 'Fri, 07 Jun 2019 09:40:26 GMT', 'Server': 'Python/3.7 aiohttp/3.5.4')>

You can see that client receives "Set-Cookie" header with domain ".example.com", but when accessing it using response.cookies the cookie has domain "example.com".

Your environment

Python 3.7.2
ArchLinux
aiohttp==3.5.4