Requests is not properly escaping cookies

Requests does not appear to be escaping cookies appropriately, which triggers this bug:

``` python
>>> import requests
>>> r = requests.get('http://httpbin.org/cookies',
...     cookies={
...       'escaped': '"a=b;b=c"',
...       'unescaped': 'x=y;y=z',
...     })
>>> print r.text
{
  "cookies": {
    "escaped": "a=b;b=c", 
    "unescaped": "x=y", 
    "y": "z"
  }
}
```

According to the RFC 2109 spec, cookies with reserved characters like `;` should be escaped with quotes. Here are the relevant definitions from that spec:

```
From RFC 2109:
   av-pairs        =       av-pair *(";" av-pair)
   av-pair         =       attr ["=" value]        ; optional value
   attr            =       token
   value           =       word
   word            =       token | quoted-string

   cookie          =       "Cookie:" cookie-version
                           1*((";" | ",") cookie-value)
   cookie-value    =       NAME "=" VALUE [";" path] [";" domain]
   cookie-version  =       "$Version" "=" value
   NAME            =       attr
   VALUE           =       value
   path            =       "$Path" "=" value
   domain          =       "$Domain" "=" value

   set-cookie      =       "Set-Cookie:" cookies
   cookies         =       1#cookie
   cookie          =       NAME "=" VALUE *(";" cookie-av)
   NAME            =       attr
   VALUE           =       value
   cookie-av       =       "Comment" "=" value
                   |       "Domain" "=" value
                   |       "Max-Age" "=" value
                   |       "Path" "=" value
                   |       "Secure"
                   |       "Version" "=" 1*DIGIT

From RFC 2068:
          token          = 1*<any CHAR except CTLs or tspecials>

          tspecials      = "(" | ")" | "<" | ">" | "@"
                         | "," | ";" | ":" | "\" | <">
                         | "/" | "[" | "]" | "?" | "="
                         | "{" | "}" | SP | HT

         quoted-string  = ( <"> *(qdtext) <"> )

          qdtext         = <any TEXT except <">>
```

If I read requests source correctly, I believe this may actually be a bug in the upstream `cookiejar` code, which doesn't appear to escape cookies when it is added to the cookie jar. However, the `cookies` jar appears to work fine:

``` python
>>> import Cookie
>>> c=Cookie.SimpleCookie()
>>> c['escaped'] = '"a=b;b=c"'
>>> c['unescaped'] = 'a=b;b=c'
>>> print c.output()
Set-Cookie: escaped="\"a=b\073b=c\""
Set-Cookie: unescaped="a=b\073b=c"
```

You can find the method that does the quoting [here](https://hg.python.org/cpython/file/c0224ff67cdd/Lib/http/cookies.py#l225).


If you tracked it upstream to the standard library, why did you open a bug here? Did you also open a bug [upstream](https://bugs.python.org)?


I wasn't completely positive if it was an upstream bug, so I wanted to
check in with you first. cookielib doesn't really to be friendly to using
it to prepare cookies, so I could see them aguing that requests should be
using Cookie/http.cookies instead.

The main reason why I filed this here though is that unfortunately my
application needs to be compatible with any Python 2.6 or above. So even if
it's fixed upstream I can't count on it being fixed for my customers. It is
much easier for me to update a requests dependency.

On Monday, October 13, 2014, Ian Cordasco notifications@github.com wrote:

> If you tracked it upstream to the standard library, why did you open a bug
> here? Did you also open a bug upstream?
> 
> —
> Reply to this email directly or view it on GitHub
> https://github.com/kennethreitz/requests/issues/2280#issuecomment-58930226
> .