```>>> from http.cookies import SimpleCookie >>> cookie_string = "ASDF=stuff; ASDF space=more stuff" >>> cookie = SimpleCookie() >>> cookie.load(cookie_string) >>> cookie.items() dict_items([]) >>> cookie_string = "ASDF=stuff" >>> cookie.load(cookie_string) >>> cookie.items() dict_items([('ASDF', <Morsel: ASDF=stuff>)])``` cookie.load should throw an error, or at least parse the cookies it can parse.
According to RFC-6265 (which also references RFC-2616 to define "tokens"), the space character (and whitespace in general) is not valid in cookie-names or cookie-values. RFC-6265: https://tools.ietf.org/html/rfc6265#section-4.1.1 RFC-2616: https://tools.ietf.org/html/rfc2616#section-2.2 I think it's reasonable for Python to quietly throw away malformed NAME=VALUE pairs since web browsers are likely doing the same.
Quietly throw out the one bad value, sure. You lose all cookies in your cookie string in this scenario. I'd expect "ASDF=stuff; ASDF space=more stuff" to at least kick out the values that are legal.
The main cause of this behaviour is that whitespace (matching the ASCII RE “\s”) is treated as separation between cookie “morsels”. It looks like this has always been the behaviour, but I’m not sure it was intended. >>> print(BaseCookie('first=morsel second=morsel')) Set-Cookie: first=morsel Set-Cookie: second=morsel This could be a security problem, if an attacker managed to inject a CSRF token as the second “morsel”. This was mentioned in <https://translate.google.com/translate?u=https://habr.com/en/post/272187/>. IMO it would be better to not split off a second morsel. Either keep it as one long morsel value with spaces in, or skip over it to the next semicolon (;). The reason why the whole cookie string is lost is due to the behaviour of cookie morsels without equals signs: >>> BaseCookie('cookie=lost; ignore').items() dict_items([]) IMO it would be better to skip over these to the next semicolon as well. It looks like this is a regression in Python 3.5+ caused by Issue 22796.
It may be relevant: Ruby accept whitespaces in the name of the morsel: ➜ ~ irb irb(main):002:0> require "cgi" => true irb(main):003:0> CGI::Cookie::parse "ASDF=stuff; ASDF space=more stuff" => {"ASDF"=>#<CGI::Cookie: "ASDF=stuff; path=">, "ASDF space"=>#<CGI::Cookie: "ASDF space=more+stuff; path=">} irb(main):004:0>
