Repository navigation
MozillaCookieJar does not handle session cookies #61366
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2013-02-08.21:23:23.026>
labels = ['3.7', '3.8', 'type-bug', 'library']
title = 'MozillaCookieJar does not handle session cookies'
updated_at = <Date 2019-02-08.16:39:40.983>
user = 'https://bugs.python.org/piotrdobrogost'bugs.python.org fields:
activity = <Date 2019-02-08.16:39:40.983>
actor = 'remi.lapeyre'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2013-02-08.21:23:23.026>
creator = 'piotr.dobrogost'
dependencies = []
files = ['37627', '37629']
hgrepos = []
issue_num = 17164
keywords = ['patch']
message_count = 6.0
messages = ['181703', '182501', '233574', '233579', '335081', '335095']
nosy_count = 5.0
nosy_names = ['orsenthil', 'piotr.dobrogost', 'jdetrey', 'remi.lapeyre', 'Ramy Abdel-Azim']
pr_nums = ['11792', '11792', '11792']
priority = 'normal'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue17164'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8']Linked PRs
- gh-61366: Write session cookies in the curl and Wget format #155602
- [3.15] gh-61366: Read session cookies written by curl and Wget (GH-11792) #155603
- [3.14] gh-61366: Read session cookies written by curl and Wget (GH-11792) #155604
- [3.13] gh-61366: Read session cookies written by curl and Wget (GH-11792) #155605
Activity
piotrdobrogost commentedon Feb 8, 2013
It seems there's no information on how should session cookies be stored in the Netscape/Mozilla's cookies.txt file with regard to expiry time - see http://www.cookiecentral.com/faq/#3.5 Maybe Netscape has not been saving such cookies at all thus this lack of specification? Nevertheless, both wget and curl use 0 as expiry time to denote session cookies; it works both when reading cookies from file and writing to file. However Python's MozillaCookieJar's class uses empty string for the same purpose which makes it incompatible both with wget and curl - see http://hg.python.org/cpython/file/bd8afb90ebf2/Lib/http/cookiejar.py#l2027
I propose to make a change in implementation of MozillaCookieJar class and treat cookies with 0 set as expiry time as session cookies both when reading from a file and writing to a file.
Motivation for this bug report comes from the following question on Stack Overflow - http://stackoverflow.com/q/14742899/95735
piotrdobrogost commentedon Feb 20, 2013
I could try to write a patch with some help if there was any chance it might be accepted. Where do I start?
jdetrey commentedon Jan 7, 2015
Dear all,
Here is a small tentative patch for fixing this issue.
Expiry times for session cookies are now written as "0", and both "0" and "" are parsed as valid expiry times for session cookies.
Cheers,
Jérémie.
jdetrey commentedon Jan 7, 2015
Hi again,
Attached is a patch for adding test cases to test_cookiejar.
Cheers,
Jérémie.
RamyAbdel-Azim commentedon Feb 8, 2019
Hi,
Is there any update on this ticket? I would love to use Requests instead of writing a curl command and running it from the command line out of my script but I need this functionality to pull the cookies.txt file in.
Thanks!
_Ramy
remilapeyre commentedon Feb 8, 2019
Hi Ramy, thanks for bumping the issue.
The solution suggested by Piotr Dobrogost is backward compatible and I think it's the right thing to do.
I opened a new PR thanks to the patch of Jérémie Detrey.
serhiy-storchaka commentedon Aug 12, 2026
There is no standard for this file format. RFC 6265 only specifies the
Set-CookieandCookieheaders, and the Netscape format was never specified. The de-facto definition is curl's documentation, which describes the expires field as "seconds since Jan 1st 1970, or 0".Reading and writing are not symmetric. I checked with curl 8.18 and Python 3.13 and 3.14:
MozillaCookieJar.save()are lost when the file is read by curl.0as an already expired timestamp and discards the cookie, so session cookies written by curl are lost when the file is read by Python.Reading both
0and the empty field is therefore safe and can be backported. But writing0makes the files incompatible with unpatched Python, including 3.13 and 3.14, so it is rather a new feature.#11792 changes both. Its test also uses
test.support.TESTFNandMozillaCookieJar.header, which no longer exist, and this is why all CI jobs fail.Fix the issue number: bpo-17164 is pythongh-61366
3 remaining items
gh-61366: Read session cookies written by curl and Wget (GH-11792)
pythongh-61366: Read session cookies written by curl and Wget (python…
pythongh-61366: Read session cookies written by curl and Wget (python…
pythongh-61366: Read session cookies written by curl and Wget (python…
pythongh-61366: Read session cookies written by curl and Wget (python…
[3.14] gh-61366: Read session cookies written by curl and Wget (GH-11792
[3.13] gh-61366: Read session cookies written by curl and Wget (GH-11792
gh-61366: Write session cookies in the curl and Wget format (GH-155602)
pythongh-61366: Read session cookies written by curl and Wget (python…
pythongh-61366: Write session cookies in the curl and Wget format (py…
[3.15] gh-61366: Read session cookies written by curl and Wget (GH-11792