kennethreitz/requests — Issue #332: Cookies are sent regardless to domain when redirecting
Author: csernazs
Created: 2012-01-04 16:00:56+00:00
State: open

Assume an HTTP server which sets the following headers when a GET request is made to "http://example1.foo/bar.cgi":

Location: http://example2.foo/bar.cgi
Set-Cookie: mycookie=something; path=/

In the case of running:

requests.get("http://example1.foo/bar.cgi")

results sending the mycookie to example2.foo/bar.cgi.

According to RFC 6265, I think the http client must not send the cookie in this case to example2.foo as example2.foo doesn't match the domain example1.foo (which is set implicitly by omitting the domain attribute in the Set-Cookie header).