Cookies with empty values are ignored and are not parsed properly from the 'set-cookie' HTTP response header

The following cookie header is not parsed properly and the response CookieJar remains empty:
Set-Cookie: 'reddit_session=; Domain=reddit.com; expires=Thu, 01-Jan-1970 00:00:01 GMT; Path=/'

It is taken from Reddit's logout url:

> > > response = requests.post('http://www.reddit.com/logout', cookies=... headers=...)
> > > 
> > > response.cookies
> > > <<class 'requests.cookies.RequestsCookieJar'[]
> > > 
> > >  response.headers
> > > {'content-length': '0', 'set-cookie': 'reddit_session=; Domain=reddit.com; expires=Thu, 01-Jan-1970 00:00:01 GMT; Path=/', 'vary': 'Accept-Encoding', 'connection': 'keep-alive', 'location': 'http://www.reddit.com/'}


Odd. I 404 on that URL, but that's obviously because I'm not logging in. if I do a GET on the home page it works fine for me.

What version of Requests are you running?


I'm using version 1.0.3 (latest).
Yes, it is hard to recreate it with Reddit since it needs all the exact headers and cookies.
A better way to approach it will be if you can simulate this exact header:

Set-Cookie:reddit_session=; Domain=reddit.com; expires=Thu, 01-Jan-1970 00:00:01 GMT; Path=/ 

put it in a mock response and see it is not parsed properly and the cookieJar (response.cookies) remains empty. 

If this answer does not help, please tell, maybe we can figure another way.

Thanks!


This cookie is set to expire in the past --- this is the standard mechanism for directing the client to remove a cookie, right? If my understanding is correct, the cookie should not be added to the jar, rather removed if present.


@slingamn :heart: 

Quite right, the cookiejar should be empty. I clearly need to take a nap. Or a holiday.

Not a bug! Thanks for the report, @odedgolan, I'm now closing this. =)


True, it is the standard mechanism for deleting cookies. 
This is why it needs to be included in the CookieJar so it can be sent in turn to a browser, and the browser can delete its local cookie.

I do not wish to use Requests as a full implementation of a browser but as a vessel for HTTP requests. 
@Lukasa @slingamn What do you think? Don't you think I'm right on this?

Thank you,
Oded.


I'm not sure I understand how you want this to work. Are you intending to use Requests as an HTTP server?


Nope, I'm using it as a proxy. 

Web Browser --> python requests --> websites
(and back), 

see http://betterinternet.co (I'm the CTO)


@odedgolan no offense, but that looks sketchy as hell.

Even so, are the cookie settings not left in `Response.headers`? Why not just pass them along from there?


+1 for @sigmavirus24 here; it sounds like you want to pass through the original headers, including the Cookie header.

However, if you really want to do this via `CookieJar`, you can write your own `CookieJar` class that implements the policy you want and then pass it in to Requests via the `cookies` kwarg. Requests has its own `RequestsCookieJar` but it's only a way to provide a convenient external API, internally we should be able to work with any `CookieJar` subclass.


@sigmavirus24 non taken, no worries. 

I cannot just pass the header, I need some manipulation ability on the cookies.

Subclassing CookieJar sounds like the right solution but passing it to Requests via cookies kwarg will set the "to send" CookieJar, not the "to receive" CookieJar.


I'm not sure I understand this send/receive distinction. But yeah, you have access to the original headers as well as our `CookieJar`, so I'm sure you'll be able to implement the behavior you want.