Backport PR #4762: whitelist alphanumeric characters for cookie_name

should fix #4761

IPython/html/base/handlers.py

@@ -23,6 +23,7 @@
 import logging
 import mimetypes
 import os
+import re
 import stat
 import threading
 
@@ -92,6 +93,7 @@ def _execute(self, transforms, *args, **kwargs):
 #-----------------------------------------------------------------------------
 # Top-level handlers
 #-----------------------------------------------------------------------------
+non_alphanum = re.compile(r'[^A-Za-z0-9]')
 
 class RequestHandler(web.RequestHandler):
     """RequestHandler with default variable setting."""
@@ -120,9 +122,9 @@ def get_current_user(self):
 
     @property
     def cookie_name(self):
-        default_cookie_name = 'username-{host}'.format(
-            host=self.request.host,
-        ).replace(':', '-')
+        default_cookie_name = non_alphanum.sub('-', 'username-{}'.format(
+            self.request.host
+        ))
         return self.settings.get('cookie_name', default_cookie_name)
 
     @property