Issue 1:
When Python Requests is used to contact a server which returns multiple Set-Cookie response headers, Python Requests combines them into one header field with the values separated by commas.

Expected Result

Using Nginx as my origin server with the following config:

location / {
root /usr/share/nginx/html;
index index.html index.htm;
add_header Set-Cookie cookieone=test;
add_header Set-Cookie cookietwo=testing;
}

Contacting this origin server I expect to receive two separate Set-Cookie headers with their corresponding values. As per RFC6265:

Origin servers SHOULD NOT fold multiple Set-Cookie header fields into

a single header field. The usual mechanism for folding HTTP headers

fields (i.e., as defined in [RFC2616]) might change the semantics of

the Set-Cookie header field because the %x2C (",") character is used

by Set-Cookie in a way that conflicts with such folding.

When using the browser my response from this origin has multiple Set-Cookie headers:

Actual Result

Python Requests folds the multiple Set-Cookie headers into a single header field separated by comma(s). For example:

>>> import requests
>>> r = requests.get('http://localhost')
>>> r
<Response [200]>
>>> r.headers
{'Content-Length': '612', 'Set-Cookie': 'cookieone=test, cookietwo=testing', 'Accept-Ranges': 'bytes', 'Server': 'nginx/1.13.9', 'Last-Modified': 'Tue, 20 Feb 2018 12:21:20 GMT', 'Connection': 'keep-alive', 'ETag': '"5a8c12c0-264"', 'Date': 'Mon, 26 Feb 2018 14:21:59 GMT', 'Content-Type': 'text/html'}
>>> r.cookies
<RequestsCookieJar[Cookie(version=0, name='cookieone', value='test', port=None, port_specified=False, domain='localhost.local', domain_specified=False, domain_initial_dot=False, path='/', path_specified=False, secure=False, expires=None, discard=True, comment=None, comment_url=None, rest={}, rfc2109=False), Cookie(version=0, name='cookietwo', value='testing', port=None, port_specified=False, domain='localhost.local', domain_specified=False, domain_initial_dot=False, path='/', path_specified=False, secure=False, expires=None, discard=True, comment=None, comment_url=None, rest={}, rfc2109=False)]>

Reproduction Steps

Set up Nginx locally (using Docker docker run -itd -p 80:80 nginx)

Use the Nginx location config above with multiple Set-Cookie headers

Call the Nginx url from the browser and notice multiple Set-Cookie headers (screenshot above)

Call the Nginx url from requests and notice a single, folded, Set-Cookie header (code above)

System Information

➜ python -m requests.help
{
"chardet": {
"version": "3.0.4"
},
"cryptography": {
"version": ""
},
"idna": {
"version": "2.6"
},
"implementation": {
"name": "CPython",
"version": "2.7.10"
},
"platform": {
"release": "17.4.0",
"system": "Darwin"
},
"pyOpenSSL": {
"openssl_version": "",
"version": null
},
"requests": {
"version": "2.18.4"
},
"system_ssl": {
"version": "20000000"
},
"urllib3": {
"version": "1.22"
},
"using_pyopenssl": false
}

Jupyterhub is an example of where this is a problem in the wild: jupyterhub/jupyterhub#1657

Issue 2:
Many web-apps send cookie in multiple Set-Cookie headers, one header for one cookie. Requests joins this headers in one big header separate by comma.

From same webapp to requests.get

Set-Cookie: ASP.NET_SessionId=token1; path=/; HttpOnly
Set-Cookie: Cookie1=token2; path=/ecp
Set-Cookie: X-BEResource=WIN-RBFR0BDA7V7.testlab.net~1; path=/ecp/15.0.516.30; HttpOnly
Set-Cookie: X-BackEndCookie=token3; expires=Mon, 03-Apr-2017 12:25:07 GMT; path=/ecp; HttpOnly

In requests:

resp.headers this look like

Set-Cookie: ASP.NET_SessionId=token1; path=/; HttpOnly,
Cookie1=token2; path=/ecp,
X-BEResource=WIN-RBFR0BDA7V7.testlab.net~1; path=/ecp/15.0.516.30; HttpOnly,
X-BackEndCookie=token3; expires=Thu, 06-Apr-2017 08:27:22 GMT; path=/ecp; HttpOnly

Firefox, IE, Chrome invalid interpreted this cookies because separater is comma but in field EXPIRES comma separate day and date.

Principal problem in modification traffic. In my opinion then server send multiple headers lib must return multiple headers