Fix host-only state on cookie expiration by Dreamsorcerer · Pull Request #13674 · aio-libs/aiohttp · GitHub
Skip to content

Fix host-only state on cookie expiration - #13674

Merged
Dreamsorcerer merged 4 commits into
masterfrom
fix-host-only-cookies
Sep 9, 2026
Merged

Dreamsorcerer merged 4 commits into
masterfrom
fix-host-only-cookies

Conversation

@Dreamsorcerer

Copy link
Copy Markdown
Member

No description provided.

@Dreamsorcerer Dreamsorcerer added backport-3.14 Trigger automatic backporting to the 3.14 release branch by Patchback robot backport-3.15 Trigger automatic backporting to the 3.15 release branch by Patchback robot labels Sep 9, 2026
@pyba-chronographer pyba-chronographer Bot added the bot:chronographer:provided There is a change note present in this PR label Sep 9, 2026
@codecov

codecov Bot commented Sep 9, 2026 •

Copy link
Copy Markdown

Comment thread aiohttp/cookiejar.py Outdated
@greptile-apps

greptile-apps Bot commented Sep 9, 2026

Copy link
Copy Markdown

Confidence Score: 5/5

Safe to merge based on direct coverage of the affected cookie-scoping behavior and its client-session integration.

No publishable defects were found. The focused check exercised the previously vulnerable expiry flow on the base revision and verified the corrected behavior in this revision, alongside replacement, persistence, and default-path cases.

Files Needing Attention: No files need follow-up attention; aiohttp/cookiejar.py, aiohttp/abc.py, and their focused tests were covered.

T-Rex T-Rex Logs

What T-Rex did

  • I ran an authored focused Python probe against the base revision and the PR revision using PYTHONPATH to load each checked-out implementation, and observed that on the base revision expiring sid on /attacker cleared the host-only state for a separate /area cookie and allowed delivery to evil.auth.example.com, while on this revision the probe passed assertions for independent path state, default-path handling, expiry isolation, exact-identity explicit-Domain replacement, persistence, and descendant-subdomain delivery restrictions.
  • I ran the cookie-jar and client-session suites; they completed with 193 passed and 1 expected skip.
  • I compared the before/after cookie-identity evidence and regression results and captured the authored probe source with its checksum to verify PR-level isolation improvements.

View all artifacts

T-Rex Ran code and verified through T-Rex

Reviews (1): Last reviewed commit: "Rename 13672.bugfix.rst to 13674.bugfix...." | Re-trigger Greptile

@codspeed

codspeed Bot commented Sep 9, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 97 untouched benchmarks
⏩ 83 skipped benchmarks1


Comparing fix-host-only-cookies (a0fc83a) with master (5789546)

Open in CodSpeed

Footnotes

  1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@Dreamsorcerer
Dreamsorcerer merged commit 9332972 into master Sep 9, 2026
53 checks passed
@Dreamsorcerer
Dreamsorcerer deleted the fix-host-only-cookies branch September 9, 2026 00:31
@patchback

patchback Bot commented Sep 9, 2026 •

Copy link
Copy Markdown
Contributor

Backport to 3.15: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 9332972 on top of patchback/backports/3.15/9332972cfcb0f5a2b6677e7307819ab8f13b5d09/pr-13674

Backporting merged PR #13674 into master

  1. Ensure you have a local repo clone of your fork. Unless you cloned it
    from the upstream, this would be your origin remote.
  2. Make sure you have an upstream repo added as a remote too. In these
    instructions you'll refer to it by the name upstream. If you don't
    have it, here's how you can add it:
    git remote add upstream https://github.com/aio-libs/aiohttp.git
    
  3. Ensure you have the latest copy of upstream and prepare a branch
    that will hold the backported code:
    git fetch upstream
    git checkout -b patchback/backports/3.15/9332972cfcb0f5a2b6677e7307819ab8f13b5d09/pr-13674 upstream/3.15
    
  4. Now, cherry-pick PR Fix host-only state on cookie expiration #13674 contents into that branch:
    git cherry-pick -x 9332972cfcb0f5a2b6677e7307819ab8f13b5d09
    
    If it'll yell at you with something like fatal: Commit 9332972cfcb0f5a2b6677e7307819ab8f13b5d09 is a merge but no -m option was given., add -m 1 as follows instead:
    git cherry-pick -m1 -x 9332972cfcb0f5a2b6677e7307819ab8f13b5d09
    
  5. At this point, you'll encounter some merge conflicts. You must
    resolve them in order to preserve the patch from PR Fix host-only state on cookie expiration #13674 as close to the
    original as possible.
  6. Once conflicts are resolved and git added, run:
    git cherry-pick --continue
    
  7. Push this branch to your fork on GitHub:
    git push origin patchback/backports/3.15/9332972cfcb0f5a2b6677e7307819ab8f13b5d09/pr-13674
    
  8. Create a PR, ensure that the CI is green. If it's not — update it so that
    the tests and any other checks pass. This is it!
    Now relax and wait for the maintainers to process your pull request
    when they have some cycles to do reviews. Don't worry — they'll tell you if
    any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

@patchback

patchback Bot commented Sep 9, 2026 •

Copy link
Copy Markdown
Contributor

Dreamsorcerer added a commit that referenced this pull request Sep 9, 2026
Dreamsorcerer added a commit that referenced this pull request Sep 9, 2026
dylanpulver added a commit to dylanpulver/aiohttp that referenced this pull request Sep 9, 2026
Resolves the conflict in aiohttp/cookiejar.py. Upstream aio-libs#13674 widened
_host_only_cookies from (domain, name) to (domain, path, name) and moved
the host-only block below the path computation, which is where the two
sides diverged.

The three hunks of this branch were re-applied onto master's ordering
rather than merged line by line. The IP scoping block now sits after the
leading-dot strip instead of before it, so the lstrip(".") calls are no
longer needed and were dropped. Behaviour is unchanged: an IP origin
falls through with an empty domain and is picked up by master's
host-only branch, which is what this branch wanted in the first place.
hugovk pushed a commit to hugovk/aiohttp that referenced this pull request Sep 15, 2026
Bumps [pip](https://github.com/pypa/pip) from 26.0.1 to 26.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's
changelog</a>.</em></p>
<blockquote>
<h1>26.1 (2026-04-26)</h1>
<h2>Deprecations and Removals</h2>
<ul>
<li>Drop support for Python 3.9.
(<code>[aio-libs#13795](pypa/pip#13795)
&lt;https://github.com/pypa/pip/issues/13795&gt;</code>_)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Add experimental support to read requirements from standardized
pylock.toml files (<code>-r pylock.toml</code>).
(<code>[aio-libs#13876](pypa/pip#13876)
&lt;https://github.com/pypa/pip/issues/13876&gt;</code>_)</li>
<li>Allow <code>--uploaded-prior-to</code> to accept a duration in days
(e.g., <code>P3D</code> for 3 days ago).
(<code>[aio-libs#13674](pypa/pip#13674)
&lt;https://github.com/pypa/pip/issues/13674&gt;</code>_)</li>
</ul>
<h2>Enhancements</h2>
<ul>
<li>Speed up dependency resolution when there are complex conflicts.
(<code>[aio-libs#13859](pypa/pip#13859)
&lt;https://github.com/pypa/pip/issues/13859&gt;</code>_)</li>
<li>Reduce memory usage when resolving large dependency trees.
(<code>[aio-libs#13843](pypa/pip#13843)
&lt;https://github.com/pypa/pip/issues/13843&gt;</code>_)</li>
<li>Emit a deprecation warning when pip imports an unexpected module
after
installation of a distribution has started.
(<code>[aio-libs#13912](pypa/pip#13912)
&lt;https://github.com/pypa/pip/issues/13912&gt;</code>_)</li>
<li>Allow URL constraints to apply to requirements with extras.
(<code>[aio-libs#12018](pypa/pip#12018)
&lt;https://github.com/pypa/pip/issues/12018&gt;</code>_)</li>
<li>Allow unpinned requirements to use hashes from constraints.
Constraints
like <code>{name}=={version} --hash=...</code> feeds into hash
verification for
a corresponding requirement.
(<code>[aio-libs#9243](pypa/pip#9243)
&lt;https://github.com/pypa/pip/issues/9243&gt;</code>_)</li>
<li>Improve conflict reports that involve direct URLs.
(<code>[aio-libs#13932](pypa/pip#13932)
&lt;https://github.com/pypa/pip/issues/13932&gt;</code>_)</li>
<li>Show all errors instead of first error for faulty
<code>dependency_groups</code> definitions.
(<code>[aio-libs#13917](pypa/pip#13917)
&lt;https://github.com/pypa/pip/issues/13917&gt;</code>_)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Fix recovery hint for missing RECORD file to use
<code>--ignore-installed</code>
instead of <code>--force-reinstall</code>.
(<code>[aio-libs#12645](pypa/pip#12645)
&lt;https://github.com/pypa/pip/issues/12645&gt;</code>_)</li>
<li>Fix misleading error message when a constraint file cannot be
opened. (<code>[aio-libs#13226](pypa/pip#13226)
&lt;https://github.com/pypa/pip/issues/13226&gt;</code>_)</li>
<li>Show the filename rather than the full URL when downloading files
from non-PyPI indexes in non-verbose mode.
(<code>[aio-libs#13494](pypa/pip#13494)
&lt;https://github.com/pypa/pip/issues/13494&gt;</code>_)</li>
<li>Remove the adjacent <code>__pycache__</code> directory when a .py
file is removed.
(<code>[aio-libs#13725](pypa/pip#13725)
&lt;https://github.com/pypa/pip/issues/13725&gt;</code>_)</li>
<li>Force UTF-8 encoding for :pep:<code>723</code> metadata.
(<code>[aio-libs#13861](pypa/pip#13861)
&lt;https://github.com/pypa/pip/issues/13861&gt;</code>_)</li>
<li>Minor performance improvement when filtering candidates during
resolution. (<code>[aio-libs#13916](pypa/pip#13916)
&lt;https://github.com/pypa/pip/issues/13916&gt;</code>_)</li>
<li>Fix a hang on Windows when stdout is closed during verbose output.
(<code>[aio-libs#13927](pypa/pip#13927)
&lt;https://github.com/pypa/pip/issues/13927&gt;</code>_)</li>
<li>Common path prefixes are determined by path segment, not character
by character. (<code>[aio-libs#13847](pypa/pip#13847)
&lt;https://github.com/pypa/pip/issues/13847&gt;</code>_)</li>
<li>Fix installing <code>.tar.gz</code> source distributions that look
like a zip file.
(<code>[aio-libs#13867](pypa/pip#13867)
&lt;https://github.com/pypa/pip/issues/13867&gt;</code>_)</li>
</ul>
<h2>Vendored Libraries</h2>
<ul>
<li>Upgrade certifi to 2026.2.25</li>
<li>Upgrade packaging to 26.2</li>
<li>Upgrade requests to 2.33.1</li>
<li>Upgrade tomli to 2.3.1</li>
<li>Upgrade urllib3 to 2.6.3</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a>
Update AUTHORS.txt</li>
<li><a
href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from
sbidoul/install-from-pylock-reqs-sbi</li>
<li><a
href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from
pypa/revert-13888-resolver-editable-links</li>
<li><a
href="https://github.com/pypa/pip/commit/122a14a8cd3dae7b3e959641f0b45849d4b21618"><code>122a14a</code></a>
Revert &quot;Allow editable installs to satisfy direct-URL dependencies
(<a
href="https://redirect.github.com/pypa/pip/issues/13888">#13888</a>)&quot;</li>
<li><a
href="https://github.com/pypa/pip/commit/c3352524aae95ae959d4727dda5b5c65752261b3"><code>c335252</code></a>
-r pylock.toml: add pip-wheel -r pylock.toml test</li>
<li><a
href="https://github.com/pypa/pip/commit/ba2fc12b7f386d89e233bdfd49e7b89d1af57ad1"><code>ba2fc12</code></a>
-r pylock.toml: proper error with remote pylock.toml containing
directory ent...</li>
<li><a
href="https://github.com/pypa/pip/commit/747c4ae88837a8bb13946fe9d1b612c162a2e3df"><code>747c4ae</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13948">#13948</a> from
ichard26/reword-news</li>
<li><a
href="https://github.com/pypa/pip/commit/3517841c5e2d92e04dbef52c61a8fa967c059efa"><code>3517841</code></a>
-r pylock: refine filename pylock-ness test</li>
<li><a
href="https://github.com/pypa/pip/commit/2f7ad8caeed4471e63958df6cacba3a66a215588"><code>2f7ad8c</code></a>
-r pylock.toml: fix crash with pip wheel and pip lock</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pip/compare/26.0.1...26.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
hugovk pushed a commit to hugovk/aiohttp that referenced this pull request Sep 15, 2026
Bumps [pip](https://github.com/pypa/pip) from 26.0.1 to 26.1.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's
changelog</a>.</em></p>
<blockquote>
<h1>26.1.1 (2026-05-04)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Fix issue where uninstallation left behind empty directories. Revert
the
removal of the adjacent <code>__pycache__</code> directory when a .py
file is removed.
(<code>[aio-libs#13973](pypa/pip#13973)
&lt;https://github.com/pypa/pip/issues/13973&gt;</code>_)</li>
</ul>
<h1>26.1 (2026-04-26)</h1>
<h2>Deprecations and Removals</h2>
<ul>
<li>Drop support for Python 3.9.
(<code>[aio-libs#13795](pypa/pip#13795)
&lt;https://github.com/pypa/pip/issues/13795&gt;</code>_)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Add experimental support to read requirements from standardized
pylock.toml files (<code>-r pylock.toml</code>).
(<code>[aio-libs#13876](pypa/pip#13876)
&lt;https://github.com/pypa/pip/issues/13876&gt;</code>_)</li>
<li>Allow <code>--uploaded-prior-to</code> to accept a duration in days
(e.g., <code>P3D</code> for 3 days ago).
(<code>[aio-libs#13674](pypa/pip#13674)
&lt;https://github.com/pypa/pip/issues/13674&gt;</code>_)</li>
</ul>
<h2>Enhancements</h2>
<ul>
<li>Speed up dependency resolution when there are complex conflicts.
(<code>[aio-libs#13859](pypa/pip#13859)
&lt;https://github.com/pypa/pip/issues/13859&gt;</code>_)</li>
<li>Reduce memory usage when resolving large dependency trees.
(<code>[aio-libs#13843](pypa/pip#13843)
&lt;https://github.com/pypa/pip/issues/13843&gt;</code>_)</li>
<li>Emit a deprecation warning when pip imports an unexpected module
after
installation of a distribution has started.
(<code>[aio-libs#13912](pypa/pip#13912)
&lt;https://github.com/pypa/pip/issues/13912&gt;</code>_)</li>
<li>Allow URL constraints to apply to requirements with extras.
(<code>[aio-libs#12018](pypa/pip#12018)
&lt;https://github.com/pypa/pip/issues/12018&gt;</code>_)</li>
<li>Allow unpinned requirements to use hashes from constraints.
Constraints
like <code>{name}=={version} --hash=...</code> feeds into hash
verification for
a corresponding requirement.
(<code>[aio-libs#9243](pypa/pip#9243)
&lt;https://github.com/pypa/pip/issues/9243&gt;</code>_)</li>
<li>Improve conflict reports that involve direct URLs.
(<code>[aio-libs#13932](pypa/pip#13932)
&lt;https://github.com/pypa/pip/issues/13932&gt;</code>_)</li>
<li>Show all errors instead of first error for faulty
<code>dependency_groups</code> definitions.
(<code>[aio-libs#13917](pypa/pip#13917)
&lt;https://github.com/pypa/pip/issues/13917&gt;</code>_)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Fix recovery hint for missing RECORD file to use
<code>--ignore-installed</code>
instead of <code>--force-reinstall</code>.
(<code>[aio-libs#12645](pypa/pip#12645)
&lt;https://github.com/pypa/pip/issues/12645&gt;</code>_)</li>
<li>Fix misleading error message when a constraint file cannot be
opened. (<code>[aio-libs#13226](pypa/pip#13226)
&lt;https://github.com/pypa/pip/issues/13226&gt;</code>_)</li>
<li>Show the filename rather than the full URL when downloading files
from non-PyPI indexes in non-verbose mode.
(<code>[aio-libs#13494](pypa/pip#13494)
&lt;https://github.com/pypa/pip/issues/13494&gt;</code>_)</li>
<li>Remove the adjacent <code>__pycache__</code> directory when a .py
file is removed.
(<code>[aio-libs#13725](pypa/pip#13725)
&lt;https://github.com/pypa/pip/issues/13725&gt;</code>_)</li>
<li>Force UTF-8 encoding for :pep:<code>723</code> metadata.
(<code>[aio-libs#13861](pypa/pip#13861)
&lt;https://github.com/pypa/pip/issues/13861&gt;</code>_)</li>
<li>Minor performance improvement when filtering candidates during
resolution. (<code>[aio-libs#13916](pypa/pip#13916)
&lt;https://github.com/pypa/pip/issues/13916&gt;</code>_)</li>
<li>Fix a hang on Windows when stdout is closed during verbose output.
(<code>[aio-libs#13927](pypa/pip#13927)
&lt;https://github.com/pypa/pip/issues/13927&gt;</code>_)</li>
<li>Common path prefixes are determined by path segment, not character
by character. (<code>[aio-libs#13847](pypa/pip#13847)
&lt;https://github.com/pypa/pip/issues/13847&gt;</code>_)</li>
<li>Fix installing <code>.tar.gz</code> source distributions that look
like a zip file.
(<code>[aio-libs#13867](pypa/pip#13867)
&lt;https://github.com/pypa/pip/issues/13867&gt;</code>_)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pip/commit/4432a371c6471e6a93c3eb39b3e9ab2b876b13b9"><code>4432a37</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/4943e17e7dd079b3f58e88009d10308f2c55a3ed"><code>4943e17</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13973">#13973</a> from
pypa/revert-13725-vfazio-remove-all-optimizati...</li>
<li><a
href="https://github.com/pypa/pip/commit/e9e7b90f35bfcd3c9e4ff93e0f0cc1b90f59aa68"><code>e9e7b90</code></a>
Add news</li>
<li><a
href="https://github.com/pypa/pip/commit/0ff696479aa07ea5ca78b08d205ae23854b6e0e8"><code>0ff6964</code></a>
Revert &quot;Remove <strong>pycache</strong> when package is
removed&quot;</li>
<li><a
href="https://github.com/pypa/pip/commit/cc6b082d6b9350d96c5a24337b12b7a42846c410"><code>cc6b082</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13951">#13951</a> from
sbidoul/release/26.1</li>
<li><a
href="https://github.com/pypa/pip/commit/b2671f1cb340f33db300f0bffc062402bce3eca0"><code>b2671f1</code></a>
Bump for development</li>
<li><a
href="https://github.com/pypa/pip/commit/90b2b3e0f7ef75c485155716d904e51654575803"><code>90b2b3e</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/193f289a6201f801b23885297332461ac8a65b6b"><code>193f289</code></a>
Update AUTHORS.txt</li>
<li><a
href="https://github.com/pypa/pip/commit/63c3709071c9596d7f4676502a90a3b06f241772"><code>63c3709</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13876">#13876</a> from
sbidoul/install-from-pylock-reqs-sbi</li>
<li><a
href="https://github.com/pypa/pip/commit/e5fe7023ffe74a5895571eaf57bdd2989018fbf2"><code>e5fe702</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/pip/issues/13949">#13949</a> from
pypa/revert-13888-resolver-editable-links</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pip/compare/26.0.1...26.1.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-3.14 Trigger automatic backporting to the 3.14 release branch by Patchback robot backport-3.15 Trigger automatic backporting to the 3.15 release branch by Patchback robot bot:chronographer:provided There is a change note present in this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant