Pylons/webob — Issue #27: Quotes in Cookie are wrongly handled
Author: liangsun
Created: 2012-02-08 04:48:01+00:00
State: open

When pyramid server send cookie to client, it enclosed the cookie value with quotes:

Set-Cookie: session="ed40dd3f394c486cf048e029a40ff6b600889e19gAJKcCExT0dB08xIXC6f3H1xAShVCHVzZXJuYW1lcQJYDgAAADNAbGlhbmdzdW4ub3JncKNVA3VpZHEESwN1h3EFLg\075\075"; Path=/

But some clients (like apache's httpclient) remove the quotes, and in the following communications, the cookie value without quotes are sent to pyramid server:

Cookie: session=ed40dd3f394c486cf048e029a40ff6b600889e19gAJKcCExT0dB08xIXC6f3H1xAShVCHVzZXJuYW1lcQJYDgAAADNAbGlhbmdzdW4ub3JncKNVA3VpZHEESwN1h3EFLg\075\075

According to RFC 2109 http://www.ietf.org/rfc/rfc2109.txt, the above two kinds of cookie values should both be supported.
But the pyramid server can't identify the cookie value without quotes and generate a new session id automatically.