CookieJar.extract_cookies doesn't process cookies form local domains when domain is explicitly set in header

[keddad]

BPO	46075
Nosy	@keddad
PRs	bpo-46075: Allow for explicit domains in CookieJar #30108

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2021-12-14.21:08:16.652>
labels = ['type-bug', 'library', '3.10', '3.11']
title = "CookieJar.extract_cookies doesn't process cookies form local domains when domain is explicitly set in header"
updated_at = <Date 2021-12-14.21:12:37.790>
user = 'https://github.com/keddad'

bugs.python.org fields:

activity = <Date 2021-12-14.21:12:37.790>
actor = 'keddad'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2021-12-14.21:08:16.652>
creator = 'keddad'
dependencies = []
files = []
hgrepos = []
issue_num = 46075
keywords = ['patch']
message_count = 1.0
messages = ['408564']
nosy_count = 1.0
nosy_names = ['keddad']
pr_nums = ['30108']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue46075'
versions = ['Python 3.10', 'Python 3.11']

[keddad]

Apparently, CookieJar.extract_cookies doesn't process cookies form local domains which explicitly set domain in Set-Cookie header. That means that headers with domain specified, like "Set-Cookie: foo=baz; Domain=localhost;", are ignored. As far as I can tell, this might be actually part of the standard: https://stackoverflow.com/questions/1134290/cookies-on-localhost-with-explicit-domain/32210291#32210291 . However, it looks like other HTTP clients, including modern versions of both Chrome and Firefox do accept cookies from localhost with explicit domain=localhost, and this change doesn't appear to break existing software in any way. (simple POC to test behavior in browsers: https://gist.github.com/keddad/e2ce034f68b77e59077cdb1e887fa4a1). Maybe it would be best to also allow this behavior in Python?

[JelleZijlstra]

Fixed in #30108 for 3.11. Thanks @keddad for your contributions!

I'm not planning to backport the change to 3.10, so I'm closing this issue.