Fix cookie parsing issues

CHANGES/11112.bugfix.rst

@@ -0,0 +1,6 @@
+Fixed cookie parsing to be more lenient when handling cookies with special characters
+in names or values. Cookies with characters like ``{``, ``}``, and ``/`` in names are now
+accepted instead of causing a :exc:`~http.cookies.CookieError` and 500 errors. Additionally,
+cookies with mismatched quotes in values are now parsed correctly, and quoted cookie
+values are now handled consistently whether or not they include special attributes
+like ``Domain`` -- by :user:`bdraco`.

CHANGES/2683.bugfix.rst

@@ -0,0 +1 @@
+11112.bugfix.rst

CHANGES/5397.bugfix.rst

@@ -0,0 +1 @@
+11112.bugfix.rst

CHANGES/7993.bugfix.rst

@@ -0,0 +1 @@
+11112.bugfix.rst

aiohttp/abc.py

@@ -2,7 +2,7 @@
 import socket
 from abc import ABC, abstractmethod
 from collections.abc import Sized
-from http.cookies import BaseCookie, CookieError, Morsel, SimpleCookie
+from http.cookies import BaseCookie, Morsel
 from typing import (
     TYPE_CHECKING,
     Any,
@@ -22,7 +22,7 @@
 from multidict import CIMultiDict
 from yarl import URL
 
-from .log import client_logger
+from .helpers import parse_cookie_headers
 from .typedefs import LooseCookies
 
 if TYPE_CHECKING:
@@ -193,26 +193,8 @@ def update_cookies(self, cookies: LooseCookies, response_url: URL = URL()) -> No
     def update_cookies_from_headers(
         self, headers: Sequence[str], response_url: URL
     ) -> None:
-        """
-        Update cookies from raw Set-Cookie headers.
-
-        Default implementation parses each header separately to preserve
-        cookies with same name but different domain/path.
-        """
-        # Default implementation for backward compatibility
-        cookies_to_update: List[Tuple[str, Morsel[str]]] = []
-        for cookie_header in headers:
-            tmp_cookie = SimpleCookie()
-            try:
-                tmp_cookie.load(cookie_header)
-                # Collect all cookies as tuples (name, morsel)
-                for name, morsel in tmp_cookie.items():
-                    cookies_to_update.append((name, morsel))
-            except CookieError as exc:
-                client_logger.warning("Can not load response cookies: %s", exc)
-
-        # Update all cookies at once for efficiency
-        if cookies_to_update:
+        """Update cookies from raw Set-Cookie headers."""
+        if headers and (cookies_to_update := parse_cookie_headers(headers)):
             self.update_cookies(cookies_to_update, response_url)
 
     @abstractmethod

aiohttp/client_reqrep.py

@@ -53,6 +53,7 @@
     is_expected_content_type,
     netrc_from_env,
     parse_mimetype,
+    preserve_morsel_with_coded_value,
     reify,
     set_exception,
     set_result,
@@ -1025,10 +1026,8 @@ def update_cookies(self, cookies: Optional[LooseCookies]) -> None:
             iter_cookies = cookies  # type: ignore[assignment]
         for name, value in iter_cookies:
             if isinstance(value, Morsel):
-                # Preserve coded_value
-                mrsl_val = value.get(value.key, Morsel())
-                mrsl_val.set(value.key, value.value, value.coded_value)
-                c[name] = mrsl_val
+                # Use helper to preserve coded_value exactly as sent by server
+                c[name] = preserve_morsel_with_coded_value(value)
             else:
                 c[name] = value  # type: ignore[assignment]
 

aiohttp/cookiejar.py

@@ -23,13 +23,12 @@
     Set,
     Tuple,
     Union,
-    cast,
 )
 
 from yarl import URL
 
 from .abc import AbstractCookieJar, ClearCookiePredicate
-from .helpers import is_ip_address
+from .helpers import is_ip_address, preserve_morsel_with_coded_value
 from .typedefs import LooseCookies, PathLike, StrOrURL
 
 __all__ = ("CookieJar", "DummyCookieJar")
@@ -374,10 +373,8 @@ def filter_cookies(self, request_url: URL) -> "BaseCookie[str]":
                     filtered[name] = self._morsel_cache[p][name]
                     continue
 
-                # It's critical we use the Morsel so the coded_value
-                # (based on cookie version) is preserved
-                mrsl_val = cast("Morsel[str]", cookie.get(cookie.key, Morsel()))
-                mrsl_val.set(cookie.key, cookie.value, cookie.coded_value)
+                # Use helper to preserve coded_value exactly as sent by server
+                mrsl_val = preserve_morsel_with_coded_value(cookie)
                 self._morsel_cache[p][name] = mrsl_val
                 filtered[name] = mrsl_val
 

aiohttp/helpers.py

@@ -21,7 +21,7 @@
 from contextlib import suppress
 from email.parser import HeaderParser
 from email.utils import parsedate
-from http.cookies import SimpleCookie
+from http.cookies import Morsel, SimpleCookie
 from math import ceil
 from pathlib import Path
 from types import MappingProxyType, TracebackType
@@ -38,10 +38,12 @@
     Mapping,
     Optional,
     Protocol,
+    Sequence,
     Tuple,
     Type,
     TypeVar,
     Union,
+    cast,
     final,
     get_args,
     overload,
@@ -54,7 +56,7 @@
 from yarl import URL
 
 from . import hdrs
-from .log import client_logger
+from .log import client_logger, internal_logger
 from .typedefs import PathLike  # noqa
 
 if sys.version_info >= (3, 11):
@@ -77,6 +79,66 @@
 
 COOKIE_MAX_LENGTH = 4096
 
+# Cookie parsing constants
+# Allow more characters in cookie names to handle real-world cookies
+# that don't strictly follow RFC standards (fixes #2683)
+# RFC 6265 defines cookie-name token as per RFC 2616 Section 2.2,
+# but many servers send cookies with characters like {} [] () etc.
+# This makes the cookie parser more tolerant of real-world cookies
+# while still providing some validation to catch obviously malformed names.
+_COOKIE_NAME_RE = re.compile(r"^[!#$%&\'()*+\-./0-9:<=>?@A-Z\[\]^_`a-z{|}~]+$")
+_COOKIE_KNOWN_ATTRS = frozenset(  # AKA Morsel._reserved
+    (
+        "path",
+        "domain",
+        "max-age",
+        "expires",
+        "secure",
+        "httponly",
+        "samesite",
+        "partitioned",
+        "version",
+        "comment",
+    )
+)
+_COOKIE_BOOL_ATTRS = frozenset(  # AKA Morsel._flags
+    ("secure", "httponly", "partitioned")
+)
+
+# SimpleCookie's pattern for parsing cookies with relaxed validation
+# Based on http.cookies pattern but extended to allow more characters in cookie names
+# to handle real-world cookies (fixes #2683)
+_COOKIE_PATTERN = re.compile(
+    r"""
+    \s*                            # Optional whitespace at start of cookie
+    (?P<key>                       # Start of group 'key'
+    # aiohttp has extended to include [] for compatibility with real-world cookies
+    [\w\d!#%&'~_`><@,:/\$\*\+\-\.\^\|\)\(\?\}\{\=\[\]]+?   # Any word of at least one letter
+    )                              # End of group 'key'
+    (                              # Optional group: there may not be a value.
+    \s*=\s*                          # Equal Sign
+    (?P<val>                         # Start of group 'val'
+    "(?:[^\\"]|\\.)*"                  # Any double-quoted string (properly closed)
+    |                                  # or
+    "[^";]*                            # Unmatched opening quote (differs from SimpleCookie - issue #7993)
+    |                                  # or
+    # Special case for "expires" attr
+    (\w{3,6}day|\w{3}),\s              # Day of the week or abbreviated day
+    [\w\d\s-]{9,11}\s[\d:]{8}\sGMT     # Date and time in specific format
+    |                                  # or
+    [\w\d!#%&'~_`><@,:/\$\*\+\-\.\^\|\)\(\?\}\{\=\[\]]*      # Any word or empty string
+    )                                # End of group 'val'
+    )?                             # End of optional value group
+    \s*                            # Any number of spaces.
+    (\s+|;|$)                      # Ending either at space, semicolon, or EOS.
+    """,
+    re.VERBOSE | re.ASCII,
+)
+
+# Cookie parsing type constants
+_TYPE_ATTRIBUTE = 1
+_TYPE_KEYVALUE = 2
+
 _T = TypeVar("_T")
 _S = TypeVar("_S")
 
@@ -1090,3 +1152,142 @@ def should_remove_content_length(method: str, code: int) -> bool:
     return code in EMPTY_BODY_STATUS_CODES or (
         200 <= code < 300 and method in hdrs.METH_CONNECT_ALL
     )
+
+
+def _set_validated_morsel_values(
+    morsel: Morsel[str],
+    name: str,
+    value: str,
+    coded_value: Optional[str] = None,
+) -> None:
+    """
+    Set Morsel values with less strict validation.
+
+    This might break between Python versions so we have it
+    isolated into a single function so we only have to change it in one place.
+    """
+    morsel._key = name  # type: ignore[attr-defined]
+    morsel._value = value  # type: ignore[attr-defined]
+    morsel._coded_value = coded_value if coded_value is not None else value  # type: ignore[attr-defined]
+
+
+def preserve_morsel_with_coded_value(cookie: Morsel[str]) -> Morsel[str]:
+    """
+    Preserve a Morsel's coded_value exactly as received from the server.
+
+    This function ensures that cookie encoding is preserved exactly as sent by
+    the server, which is critical for compatibility with old servers that have
+    strict requirements about cookie formats.
+
+    This addresses the issue described in https://github.com/aio-libs/aiohttp/pull/1453
+    where Python's SimpleCookie would re-encode cookies, breaking authentication
+    with certain servers.
+
+    Args:
+        cookie: A Morsel object from SimpleCookie
+
+    Returns:
+        A Morsel object with preserved coded_value
+
+    """
+    mrsl_val = cast("Morsel[str]", cookie.get(cookie.key, Morsel()))
+    _set_validated_morsel_values(mrsl_val, cookie.key, cookie.value, cookie.coded_value)
+    return mrsl_val
+
+
+def _unquote(text: str) -> str:
+    """
+    Unquote a cookie value.
+
+    Vendored from http.cookies._unquote to ensure compatibility.
+    """
+    # If there are no quotes, return as-is
+    if len(text) < 2 or text[0] != '"' or text[-1] != '"':
+        return text
+    # Remove quotes and handle escaped characters
+    text = text[1:-1]
+    # Replace escaped quotes and backslashes
+    text = text.replace('\\"', '"').replace("\\\\", "\\")
+    return text
+
+
+def parse_cookie_headers(headers: Sequence[str]) -> List[Tuple[str, Morsel[str]]]:
+    """
+    Parse cookie headers using a vendored version of SimpleCookie parsing.
+
+    This implementation is based on SimpleCookie.__parse_string to ensure
+    compatibility with how SimpleCookie parses cookies, including handling
+    of malformed cookies with missing semicolons.
+
+    NOTE: This implementation differs from SimpleCookie in handling unmatched quotes.
+    SimpleCookie will stop parsing when it encounters a cookie value with an unmatched
+    quote (e.g., 'cookie="value'), causing subsequent cookies to be silently dropped.
+    This implementation handles unmatched quotes more gracefully to prevent cookie loss.
+    See https://github.com/aio-libs/aiohttp/issues/7993
+    """
+    parsed_cookies: List[Tuple[str, Morsel[str]]] = []
+
+    for header in headers:
+        if not header:
+            continue
+
+        # Parse cookie string using SimpleCookie's algorithm
+        i = 0
+        n = len(header)
+        current_morsel: Optional[Morsel[str]] = None
+        morsel_seen = False
+
+        while 0 <= i < n:
+            # Start looking for a cookie
+            match = _COOKIE_PATTERN.match(header, i)
+            if not match:
+                # No more cookies
+                break
+
+            key, value = match.group("key"), match.group("val")
+            i = match.end(0)
+            lower_key = key.lower()
+
+            if key[0] == "$":
+                if not morsel_seen:
+                    # We ignore attributes which pertain to the cookie
+                    # mechanism as a whole, such as "$Version".
+                    continue
+                # Process as attribute
+                if current_morsel is not None:
+                    attr_lower_key = lower_key[1:]
+                    if attr_lower_key in _COOKIE_KNOWN_ATTRS:
+                        current_morsel[attr_lower_key] = value or ""
+            elif lower_key in _COOKIE_KNOWN_ATTRS:
+                if not morsel_seen:
+                    # Invalid cookie string - attribute before cookie
+                    break
+                if lower_key in _COOKIE_BOOL_ATTRS:
+                    # Boolean attribute with any value should be True
+                    if current_morsel is not None:
+                        current_morsel[lower_key] = True
+                elif value is None:
+                    # Invalid cookie string - non-boolean attribute without value
+                    break
+                elif current_morsel is not None:
+                    # Regular attribute with value
+                    current_morsel[lower_key] = _unquote(value)
+            elif value is not None:
+                # This is a cookie name=value pair
+                # Validate the name
+                if key in _COOKIE_KNOWN_ATTRS or not _COOKIE_NAME_RE.match(key):
+                    internal_logger.warning(
+                        "Can not load response cookies: Illegal cookie name %r", key
+                    )
+                    current_morsel = None
+                else:
+                    # Create new morsel
+                    current_morsel = Morsel()
+                    _set_validated_morsel_values(current_morsel, key, _unquote(value))
+                    parsed_cookies.append((key, current_morsel))
+                    morsel_seen = True
+            else:
+                # Invalid cookie string - no value for non-attribute
+                break
+
+    return parsed_cookies

aiohttp/web_request.py

@@ -7,7 +7,6 @@
 import sys
 import tempfile
 import types
-from http.cookies import SimpleCookie
 from types import MappingProxyType
 from typing import (
     TYPE_CHECKING,
@@ -39,6 +38,7 @@
     HeadersMixin,
     frozen_dataclass_decorator,
     is_expected_content_type,
+    parse_cookie_headers,
     parse_http_date,
     reify,
     sentinel,
@@ -557,8 +557,10 @@ def cookies(self) -> Mapping[str, str]:
         A read-only dictionary-like object.
         """
         raw = self.headers.get(hdrs.COOKIE, "")
-        parsed = SimpleCookie(raw)
-        return MappingProxyType({key: val.value for key, val in parsed.items()})
+        # Use parse_cookie_headers for more lenient parsing that accepts
+        # special characters in cookie names (fixes #2683)
+        parsed = parse_cookie_headers([raw])
+        return MappingProxyType({name: morsel.value for name, morsel in parsed})
 
     @reify
     def http_range(self) -> "slice[int, int, int]":