Session Cookie doublequotes bug

test code:

``` Python
from requests import session

with session() as c:
    c.get('http://www.baidu.com')
    #should have cookie headers
    c.get('http://www.baidu.com')
```

Server:

``` Python
Set-Cookie: BAIDUID=DC1510722CF5A19A2A4C4E4DB720C5D4:FG=1; expires=Wed, 23-Nov-41 17:44:00 GMT; path=/; domain=.baidu.com
```

Client:

``` Python
Cookie: BAIDUID="DC1510722CF5A19A2A4C4E4DB720C5D4:FG=1"
```

The correct result should be:

``` Python
Cookie: BAIDUID=DC1510722CF5A19A2A4C4E4DB720C5D4:FG=1
```

quote function 

``` Python
def _quote(str, LegalChars=_LegalChars,
           idmap=_idmap, translate=string.translate):
    #
    # If the string does not need to be double-quoted,
    # then just return the string.  Otherwise, surround
    # the string in doublequotes and precede quote (with a \)
    # special characters.
    #
    if "" == translate(str, idmap, LegalChars):
        return str
    else:
        return '"' + _nulljoin( map(_Translator.get, str, str) ) + '"'
# end _quote
```


It's because `:` is not regarded as legal character according to
 `_LegalChars = string.ascii_letters + string.digits + "!#$%&'*+-.^_`|~[]_"`
declaration. Do you think it should be regarded as legal? Can you quote specification?


urllib2 with CookieJia works.
Web server can not get the cookie which requests send like this.

You can test it.


Yes, I use Chalers to observe the http header.


Yes, I use wireshark, It wokrs.
Strange ah.


Sorry, I have commented the _quote function, so there is still a problem.


Format of cookies is defined in RFC 2109. In section 4.1 value part of cookie is defined as `token | quoted-string`. `token` is defined in section 2.2 of RFC 2068 as `1*<any CHAR except CTLs or tspecials>` and _tspecials_ are defined as `tspecials = "(" | ")" | "<" | ">" | "@" | "," | ";" | ":" | "\" | <"> | "/" | "[" | "]" | "?" | "=" | "{" | "}" | SP | HT`. According to this `:` is a special character and any cookie's value with this character should be quoted. The behavior of Requests which you observe is in line with the specification. It's worth noting that as every cookie's value can be quoted the server should accept any such cookie. Btw. `[` and `]` are special so they should be absent from `_LegalChars`'s value I guess but it's a question to @kennethreitz


I think the cookie value should not be handled this way.

Firefox post header

``` Python
Cookie: BAIDUID=F91F6B66270A04AC62CF28612B5F1CFA:FG=1
```


Visiting `http://httpbin.org/cookies/set/BAIDUID/7F6CA76A7A24F81BB1A6D40FB6080A05:FG=1` in Firefox 8.0.1 results in the `Set-Cookie: BAIDUID="7F6CA76A7A24F81BB1A6D40FB6080A05:FG=1"; Path=/` in the response and subsequent request to `http://httpbin.org/cookies` has this header `Cookie: BAIDUID="7F6CA76A7A24F81BB1A6D40FB6080A05:FG=1"`. It looks like Firefox keeps and sends the original form of the cookie it receives. That being said it's just how this particular UA works and Borland Web Server (BWS/1.0) is broken in respect to handling quoted cookies if it

> (...) can not get the cookie which requests send like this.


Yes, so I think Requests should do like Firefox.


Some server doesn't accept quoted cookie, it is annoying.
At least, requests should provide an option/flag to whether to quote cookie.


This issue burned me too. I got a session cookie with a colon and the server choked on the quotes requests.py was using.

For multiple requests through the same session, it seems like you could remember how the cookie was encoded and preserve that. For letting users easily specify the behaviour they want when they're passing cookies themselves, I have no idea.

My solution was to encode the cookie header myself, which wasn't too bad because there was only the one cookie to pass.