Cookie headers prefixed with $ are parsed incorrectly
See original GitHub issueChrome will let you export a network call as curl by right clicking it -> copy -> copy as curl.
Chrome also likes to export long cookies like such:
curl 'https://someurl.com' \
-H 'Connection: keep-alive' \
-H 'Cache-Control: max-age=0' \
-H 'sec-ch-ua: "Google Chrome"; v="83"' \
-H 'sec-ch-ua-mobile: ?0' \
-H 'DNT: 1' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4093.3 Safari/537.36' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9' \
-H 'Sec-Fetch-Site: none' \
-H 'Sec-Fetch-Mode: navigate' \
-H 'Sec-Fetch-User: ?1' \
-H 'Sec-Fetch-Dest: document' \
-H 'Accept-Language: en-US,en;q=0.9,it;q=0.8,la;q=0.7' \
-H $'Cookie: somereallyreallylongcookie=true;' \
--compressed
This gets parsed as
cookies = {
'$Cookie: somereallyreallylongcookie': 'true',
}
in python, while in reality the $ should effectively be omitted, and the cookie itself should be parsed correctly.
Issue Analytics
- State:
- Created 3 years ago
- Reactions:1
- Comments:6 (2 by maintainers)
Top Results From Across the Web
Cookie headers prefixed with $ are parsed incorrectly · Issue #207 ...
I honestly don't know bash well enough to understand what the dollar sign is doing here, but Firefox's copy-as-curl command put it there,...
Read more >What does the dot prefix in the cookie domain mean?
The leading dot means that the cookie is valid for subdomains as well; ... domains are explicitly lower cased when parsing the Set-Cookie...
Read more >Set-Cookie header parsing issue - Google Cloud Community
For parsing cookies of the form you described: The short answer is: Don't split on commas. You can parse the cookie string with...
Read more >Set-Cookie - HTTP - MDN Web Docs
The Set-Cookie HTTP response header is used to send a cookie from the server to the user agent, so that the user agent...
Read more >RFC 6265 - HTTP State Management Mechanism
This document defines the HTTP Cookie and Set-Cookie header fields. These header fields can be used by HTTP servers to store state (called...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Nice, great investigation!
Should be pretty straight forward to have it unescape strings prefixed with
$'
This was solved by #278