This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: comma separated cookie values
Type: behavior Stage: resolved
Components: Library (Lib) Versions: Python 2.4
process
Status: closed Resolution: not a bug
Dependencies: Superseder:
Assigned To: akuchling Nosy List: ajaksu2, akuchling, jjlee, tovo
Priority: low Keywords:

Created on 2005-05-28 10:13 by tovo, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (6)
msg25433 - (view) Author: tvogt (tovo) Date: 2005-05-28 10:13
According to RFC 2109

"For backward compatibility, the separator in the
Cookie header
is semi-colon (;) everywhere.  A server should also
accept comma (,)
as the separator between cookie-values for future
compatibility."

The Cookie standard module does not support this as it
should.

>>> import Cookie
>>> c=Cookie.SimpleCookie()
>>> c.load('foo=2, bar=3')
>>> print c['foo'].value
2,

msg25434 - (view) Author: A.M. Kuchling (akuchling) * (Python committer) Date: 2005-06-01 23:19
Logged In: YES 
user_id=11375

The updated cookie RFC, RFC 2965, also has this language.
msg25435 - (view) Author: John J Lee (jjlee) Date: 2005-06-29 19:34
Logged In: YES 
user_id=261020

Unfortunately one can't take the cookie specs at face value.

Netscape cookies behaviour (the de-facto standard, ie. IE &
Firefox behaviour -- cookie_spec.html is barely worth the
web page it's written on, being flat-out wrong in several
major ways, and very under-specified) has, I'm told, always
simply been simply "split on semicolons".  Certainly that's
what IE and Mozilla do now:

(this is just the text of a CGI for viewing: I didn't make
it executable on reportlab.org)

http://www.reportlab.org/~jjlee/cookie_demo.py

IIRC RFC 2965 is only implemented by Opera, and is certainly
now quite dead as an internet standard.  (though I think it
is useful as a guide for writing cookie-handling code, you
can't follow blindly - not even close :-( )
msg25436 - (view) Author: John J Lee (jjlee) Date: 2005-06-29 19:53
Logged In: YES 
user_id=261020

Forgot to add or demo in that CGI script: even

Set-Cookie: abc=def, ghi=jkl

is just one Netscape cookie, name 'abc', value 'def, ghi=jkl'.
msg25437 - (view) Author: John J Lee (jjlee) Date: 2005-07-15 18:12
Logged In: YES 
user_id=261020

I notice I didn't say explicitly: I think this should be
closed, for the reasons given in my last two comments.
msg81844 - (view) Author: Daniel Diniz (ajaksu2) * (Python triager) Date: 2009-02-13 01:17
Will close if nobody objects.
History
Date User Action Args
2022-04-11 14:56:11adminsetgithub: 42026
2012-10-30 13:37:31r.david.murraylinkissue16362 superseder
2009-02-20 01:53:05ajaksu2setstatus: pending -> closed
resolution: not a bug
stage: resolved
2009-02-18 01:52:28ajaksu2setstatus: open -> pending
priority: normal -> low
2009-02-13 01:17:30ajaksu2setnosy: + ajaksu2
type: behavior
messages: + msg81844
2005-05-28 10:13:30tovocreate