Copy unsafe setting from session cookie jar to ad-hoc request cookie jar#12271
Merged
Dreamsorcerer merged 6 commits intoaio-libs:masterfrom Mar 25, 2026
Merged
Conversation
When ad-hoc cookies are passed to individual requests via the `cookies` parameter, a temporary `CookieJar` is created to filter them. Previously, only the `quote_cookie` setting was copied from the session's cookie jar. This meant that if the session's cookie jar had `unsafe=True` (to allow cookies with IP addresses), the ad-hoc cookies would still be filtered out by the temporary jar's default `unsafe=False` setting. This copies the `unsafe` setting from the session's cookie jar to the temporary cookie jar, and also exposes `unsafe` as a public property on `AbstractCookieJar`, `CookieJar`, and `DummyCookieJar` (mirroring the existing `quote_cookie` property). Closes aio-libs#12011
psf-chronographer
bot
added
the
bot:chronographer:provided
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #12271 +/- ##
=======================================
Coverage 99.10% 99.10%
=======================================
Files 130 130
Lines 45432 45465 +33
Branches 2400 2400
=======================================
+ Hits 45027 45060 +33
Misses 273 273
Partials 132 132
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Dreamsorcerer
approved these changes
Mar 25, 2026
Dreamsorcerer
added
the
backport-3.14
- Simplify handler to return web.Response() since response text is unused
- Add sanity check that test URL is IP-based (assert str(ip_url).count(".") == 3)
- Use async with for request to handle errors better
- Add assert jar.unsafe is False for missing coverage
Contributor
Backport to 3.14: 💚 backport PR created✅ Backport PR branch: Backported as #12274 🤖 @patchback |
6 tasks
Dreamsorcerer
pushed a commit
that referenced
this pull request
Mar 25, 2026
…cookie jar to ad-hoc request cookie jar (#12274) **This is a backport of PR #12271 as merged into master (e04da11).** Co-authored-by: Krishna Chaitanya <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #12011
When ad-hoc cookies are passed to individual requests via the
cookiesparameter, a temporaryCookieJaris created to filter them. Previously, only thequote_cookiesetting was copied from the session's cookie jar. This meant that if the session's cookie jar hadunsafe=True(to allow cookies with IP addresses), the ad-hoc cookies would still be filtered out by the temporary jar's defaultunsafe=Falsesetting.This change:
unsafesetting from the session's cookie jar to the temporary cookie jar used for ad-hoc request cookiesunsafeas a public abstract property onAbstractCookieJar(mirroring the existingquote_cookieproperty)unsafeproperty onCookieJarandDummyCookieJarThis approach was explicitly approved by maintainers @Dreamsorcerer and @bdraco in the issue discussion.
Test plan
test_cookies_with_unsafe_cookie_jarintest_client_session.pyverifying ad-hoc cookies are sent when the session cookie jar hasunsafe=Trueand the target URL uses an IP addresstest_cookie_jar_unsafe_propertyintest_cookiejar.pyverifying the newunsafeproperty onCookieJarDummyCookieJar.unsafein the existingtest_dummy_cookie_jartestMockCookieJarin test suite to implement the new abstractunsafeproperty