Pylons/pyramid — Issue #429: Quotes in Cookie are wrongly handled
Author: liangsun
Created: 2012-02-08 04:03:07+00:00
State: open

When server set cookie, it enclosed the session value with quotes:

Set-Cookie: session="ed40dd3f394c486cf048e029a40ff6b600889e19gAJKcCExT0dB08xIXC6f3H1xAShVCHVzZXJu
YW1lcQJYDgAAADNAbGlhbmdzdW4ub3JncKNVA3VpZHEESwN1h3EFLg\075\075"; Path=/

But some clients (like apache's httpclient) remove the quotes, and in the following communications, the value without quotes are sent to pyramid server:

Cookie: session=ed40dd3f394c486cf048e029a40ff6b600889e19gAJKcCExT0dB08xIXC6f3H1xAShVCHVzZXJuYW1lcQJYD
gAAADNAbGlhbmdzdW4ub3JncKNVA3VpZHEESwN1h3EFLg\075\075

According to RFC 2109, the above session values should all be supported.
But the pyramid server can't identify the session value without quotes and generate a new session value automatically.