iframe-proxy

bdraco · 2026-10-03T13:07:04Z

What do these changes do?

Add limits to client cookie handling. Each Set-Cookie field now produces exactly one cookie, as browsers do, and CookieJar caps how many cookies it stores and how large a Cookie header it builds. Eviction follows Firefox, so expired and non secure cookies go first, least recently used first.

Are there changes in behavior for the user?

The jar applies these limits:

50 Set-Cookie fields per response, 32 attributes per field;
4,096 octets for a cookie's name and value, 1,024 octets per attribute value;
180 cookies per domain and 3,300 in total;
150 cookies and 8,190 octets per Cookie request header.

Extra name=value pairs after the first one in a Set-Cookie field are now ignored instead of becoming separate cookies; see the breaking fragment. Cookies passed with cookies= and an explicit Cookie header are not limited.

Is it a substantial burden for the maintainers to support this?

No, the limits are private constants and there is no new public API.

Related issue number

N/A

Checklist

I think the code is well written
Unit tests for the changes exist
Documentation reflects the changes
If you provide code modification, please add yourself to CONTRIBUTORS.txt
- The format is <Name> <Surname>.
- Please keep alphabetical order, the file is sorted by names.
Add a new news fragment into the CHANGES/ folder
- name it <issue_or_pr_num>.<type>.rst (e.g. 588.bugfix.rst)
- if you don't have an issue number, change it to the pull request
  number after creating the PR
  - .bugfix: A bug fix for something the maintainers deemed an
    improper undesired behavior that got corrected to match
    pre-agreed expectations.
  - .feature: A new behavior, public APIs. That sort of stuff.
  - .deprecation: A declaration of future API removals and breaking
    changes in behavior.
  - .breaking: When something public is removed in a breaking way.
    Could be deprecated in an earlier release.
  - .doc: Notable updates to the documentation structure or build
    process.
  - .packaging: Notes for downstreams about unobvious side effects
    and tooling. Changes in the test invocation considerations and
    runtime assumptions.
  - .contrib: Stuff that affects the contributor experience. e.g.
    Running tests, building the docs, setting up the development
    environment.
  - .misc: Changes that are hard to assign to any of the above
    categories.
- Make sure to use full sentences with correct case and punctuation,
  for example:
```
Fixed issue with non-ascii contents in doctest text files
-- by :user:`contributor-gh-handle`.
```
  Use the past tense or the present tense a non-imperative mood,
  referring to what's changed compared to the last released version
  of this project.

Local test run

pytest (full suite, xdist): 5833 passed, 25 skipped, 17 xfailed
cookie and client tests, C extensions: 863 passed, 4 skipped, 1 xfailed
cookie and client tests, AIOHTTP_NO_EXTENSIONS=1: 863 passed, 4 skipped, 1 xfailed

Drafted with Claude Opus 5.5; reviewed by @bdraco.

Co-authored-by: J. Nick Koston <nick@koston.org>

agentscanapp · 2026-10-03T13:07:09Z

codecov · 2026-10-03T13:09:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.09%. Comparing base (470daa7) to head (e41e211).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #13930      +/-   ##
==========================================
+ Coverage   99.06%   99.09%   +0.03%     
==========================================
  Files         135      135              
  Lines       52582    53491     +909     
  Branches     2739     2806      +67     
==========================================
+ Hits        52092    53009     +917     
+ Misses        369      363       -6     
+ Partials      121      119       -2

Flag	Coverage Δ
Autobahn	`21.69% <14.35%> (-0.12%)`	⬇️
CI-GHA	`98.93% <100.00%> (+0.03%)`	⬆️
OS-Linux	`98.72% <100.00%> (+0.03%)`	⬆️
OS-Windows	`97.38% <100.00%> (+0.06%)`	⬆️
OS-macOS	`98.25% <100.00%> (+0.04%)`	⬆️
Py-3.10	`98.16% <100.00%> (+0.04%)`	⬆️
Py-3.11	`98.40% <100.00%> (+0.04%)`	⬆️
Py-3.12	`98.48% <100.00%> (+0.03%)`	⬆️
Py-3.13	`98.48% <100.00%> (+0.04%)`	⬆️
Py-3.14	`98.50% <99.81%> (+0.02%)`	⬆️
Py-3.15	`98.50% <99.81%> (+0.02%)`	⬆️
Py-3.15t	`97.91% <99.81%> (+0.04%)`	⬆️
Py-pypy-3.12	`96.57% <100.00%> (+0.07%)`	⬆️
VM-macos	`98.25% <100.00%> (+0.04%)`	⬆️
VM-ubuntu	`98.72% <100.00%> (+0.03%)`	⬆️
VM-windows	`97.38% <100.00%> (+0.06%)`	⬆️
cython-coverage	`83.59% <71.90%> (-0.10%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

aiolibsbot · 2026-10-03T13:23:56Z

~~Previous review~~ — superseded by a newer review below.

aiolibsbot · 2026-10-03T19:14:55Z

@bdraco: > 1. load() no longer calls a subclass's update_cookies() and copies a plain CookieJar's state

Agreed. Finding dropped. Subclass load() path stays as is.

aiolibsbot · 2026-10-03T19:14:58Z

~~Previous review~~ — superseded by a newer review below.

bdraco · 2026-10-03T19:19:09Z

Flags past the 32-attribute cap are dropped without a log
aiohttp/_cookie_helpers.py:298

these are unrealistic and browsers drop it without a log, decline

bdraco · 2026-10-03T19:19:45Z

_can_send accepts cookies too large to ever be sent
aiohttp/cookiejar.py:733-738

decline, another check for a crazy edge case doesn't justify the performance hit just to log garbage

aiolibsbot · 2026-10-03T19:20:50Z

@bdraco: > 1. Flags past the 32-attribute cap are dropped without a log

Accepted. Attribute-cap logging dropped. Matches browser behaviour.

aiolibsbot · 2026-10-03T19:20:51Z

@bdraco: > 2. _can_send accepts cookies too large to ever be sent

Accepted. No size check in _can_send. Hot path stays lean.

aiolibsbot · 2026-10-03T19:20:54Z

~~Previous review~~ — superseded by a newer review below.

bdraco · 2026-10-03T19:40:48Z

performance is fixed now. I've cleaned it up as much as I think I can.

want to sleep on it and look at it with fresh eyes though

Its just bigger than I would like, but a limit, validation, and eviction system for cookies was already going to be big

bdraco · 2026-10-04T11:17:36Z

A structurally better design would be keep containers in sync by storing things that cannot be allowed out of sync in the same container but its probably way to big to put in this PR and than we have to go get the performance right on that again, and I couldn't come up with a design that didn't make this PR 1000 lines longer and was performant. Too much mitigate risk, so going to put that on the shelf as its a larger refactor down the road when we want it

bdraco · 2026-10-04T11:18:13Z

I'm just going to add consistency tests instead as thats the right call to make sure the containers are never out of sync without massively expanding scope

aiolibsbot · 2026-10-04T11:43:51Z

@bdraco: I'm just going to add consistency tests instead as thats the right call to make sure the containers ...

Consistency test landed in bcde497. Covers update, filter, clear, save/load. Mutation through jar.cookies[...] stays uncovered. Tracked as deferred finding.

aiolibsbot · 2026-10-04T11:43:54Z

PR Review — Add limits for client cookie handling

Merge-ready. The only new commit, bcde497, adds a randomized test that checks the jar's bookkeeping, as @bdraco planned. Two non-blocking suggestions remain.

What's good:

The new consistency test is strong. _assert_consistent checks every piece of bookkeeping against the cookies actually stored: _cookie_count, _domain_counts, _access_generations, host-only keys, _expirations and the morsel cache.
It runs 3,000 random operations with small limits. These cover header updates, update_cookies, filter_cookies, clear with a predicate, clear_domain, save/load and full clear. Because the limits are small, eviction, purging and the Cookie header limits are exercised constantly, and a fixed seed keeps the run reproducible.
The design is unchanged and still holds up: one cookie per Set-Cookie field, Firefox-style eviction with O(1) counters, the most specific cookies kept first when the header is too big, an atomic load(), and the threat-model section §5.16.

Findings and earlier dispositions:

Inner SimpleCookie buckets are still mutable, so the counters can drift. Downgraded to [Deferred] per @bdraco, who plans a later refactor and added the consistency tests instead.
load() stages into a base CookieJar, so subclass overrides are skipped. Low-impact suggestion.
Earlier logging requests (warning-level logs for evictions on load and for cookies left out of the header) are not raised again. This is in line with @bdraco's earlier decision to decline extra logging for edge cases, and the debug logs already exist.
The CodeQL alerts on tests/test_benchmarks_cookiejar.py:10 (unused import) and on jar in test_update_cookies_rejects_cookie_that_cannot_be_sent (possibly uninitialized) are still false positives.

Checklist

No hardcoded secrets
Input validation at boundaries (Set-Cookie parsing, update_cookies, load())
Unbounded collections bounded (jar, morsel cache, expiry heap)
Internal bookkeeping consistent with stored contents
Subclass/extension behaviour preserved
Docs, changelog and threat model reflect behaviour changes
New branches covered by tests

ℹ️ Triage summary

2 pre-existing finding(s) on unchanged code suppressed (freeze).

Silent Failure Analysis

🟡 **1. MEDIUM** — trusted caller input silently dropped
aiohttp/cookiejar.py:560-566

Risk: The public update_cookies() API takes trusted application input, so a cookie value with a control character or an unencodable surrogate used to fail loudly at the writer, but now it vanishes with only a debug-level log that production rarely shows, and the caller can't tell the cookie was never stored.

if check_sendable and self._limits_enabled and not self._can_send(cookie):
    internal_logger.debug(
        "Dropped cookie %r for %s: it can't be sent in a Cookie header",
        name,
        domain,
    )
    continue

Fix: For caller-supplied cookies (copy_morsels=True), raise ValueError/CookieError or at least log at warning level, and keep the quiet drop only for untrusted Set-Cookie input.

🟡 **2. MEDIUM** — partial load silently accepted
aiohttp/cookiejar.py:226-283

Risk: The load() docstring says a malformed file raises and leaves the jar unchanged, but only non-finite expiries and type errors raise; records that are unencodable, fail the domain check, or are dropped by eviction or the full-of-Secure rule disappear silently, so a corrupted or tampered jar file can come back as a partial jar with no signal.

loaded._update_cookies(
    {name: morsel},
    response_url,
    copy_morsels=False,
    expiration=expiration,
)

Fix: Count the records _update_cookies rejects during load() and either raise or log a warning with that count, and make the docstring say which malformations raise and which are skipped.

🟡 **3. MEDIUM** — subclass override silently bypassed
aiohttp/cookiejar.py:229-233

Risk: load() used to route records through self.update_cookies(), so a subclass's own filtering or validation ran on loaded cookies; now it fills a plain CookieJar and copies its __dict__ across, which silently skips any overridden update_cookies/_update_cookies hooks.

loaded = CookieJar(
    unsafe=self._unsafe,
    quote_cookie=self._quote_cookie,
    treat_as_secure_origin=self._treat_as_secure_origin,
)

Fix: Build the staging jar with type(self) (or call self.update_cookies into the staging state) so subclass hooks still apply, or document the behaviour change in the breaking changelog.

🟡 **4. MEDIUM** — silent truncation drops security attribute
aiohttp/_cookie_helpers.py:297-300

Risk: Once 32 attribute segments have been parsed, the rest of the field is dropped with no log; a Secure (or Domain/Path) that comes after them is lost, so the stored cookie can later go out over plain HTTP and nothing shows that parsing stopped.

for _ in range(_MAX_COOKIE_ATTRIBUTES):
    if index >= end:
        break
    if (attribute_match := _COOKIE_PATTERN.match(attributes, index)) is None:

Fix: Emit a debug log (counted in the existing per-response summary) when the attribute limit cuts parsing short; optionally keep scanning, without storing anything, just for the Secure flag so the cap can't widen where the cookie is sent.

Automated review by Kōan (Claude) HEAD=bcde497 1 min 31s

bdraco · 2026-10-04T19:11:46Z

All good on the second Home Assistant instance

bdraco · 2026-10-04T19:12:57Z

Greptile's complaint about threat model being removed is not an issue as it was removed per maintainer request and will be added in a followup pr

patchback · 2026-10-04T19:24:26Z

Backport to 3.15: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply b1f6c87 on top of patchback/backports/3.15/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412/pr-13930

Backporting merged PR #13930 into master

Ensure you have a local repo clone of your fork. Unless you cloned it
from the upstream, this would be your origin remote.
Make sure you have an upstream repo added as a remote too. In these
instructions you'll refer to it by the name upstream. If you don't
have it, here's how you can add it:
```
git remote add upstream https://github.com/aio-libs/aiohttp.git
```

Ensure you have the latest copy of upstream and prepare a branch
that will hold the backported code:

git fetch upstream
git checkout -b patchback/backports/3.15/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412/pr-13930 upstream/3.15

Now, cherry-pick PR Add limits for client cookie handling #13930 contents into that branch:
```
git cherry-pick -x b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412
```
If it'll yell at you with something like fatal: Commit b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412 is a merge but no -m option was given., add -m 1 as follows instead:
```
git cherry-pick -m1 -x b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412
```
At this point, you'll encounter some merge conflicts. You must
resolve them in order to preserve the patch from PR Add limits for client cookie handling #13930 as close to the
original as possible.
Once conflicts are resolved and git added, run:
```
git cherry-pick --continue
```

Push this branch to your fork on GitHub:

git push origin patchback/backports/3.15/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412/pr-13930

Create a PR, ensure that the CI is green. If it's not — update it so that
the tests and any other checks pass. This is it!
Now relax and wait for the maintainers to process your pull request
when they have some cycles to do reviews. Don't worry — they'll tell you if
any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

patchback · 2026-10-04T19:24:34Z

Backport to 3.14: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply b1f6c87 on top of patchback/backports/3.14/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412/pr-13930

Backporting merged PR #13930 into master

Ensure you have a local repo clone of your fork. Unless you cloned it
from the upstream, this would be your origin remote.
Make sure you have an upstream repo added as a remote too. In these
instructions you'll refer to it by the name upstream. If you don't
have it, here's how you can add it:
```
git remote add upstream https://github.com/aio-libs/aiohttp.git
```

Ensure you have the latest copy of upstream and prepare a branch
that will hold the backported code:

git fetch upstream
git checkout -b patchback/backports/3.14/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412/pr-13930 upstream/3.14

Now, cherry-pick PR Add limits for client cookie handling #13930 contents into that branch:
```
git cherry-pick -x b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412
```
If it'll yell at you with something like fatal: Commit b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412 is a merge but no -m option was given., add -m 1 as follows instead:
```
git cherry-pick -m1 -x b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412
```
At this point, you'll encounter some merge conflicts. You must
resolve them in order to preserve the patch from PR Add limits for client cookie handling #13930 as close to the
original as possible.
Once conflicts are resolved and git added, run:
```
git cherry-pick --continue
```

Push this branch to your fork on GitHub:

git push origin patchback/backports/3.14/b1f6c87b2bd3bd80f2b6c22ff46e11d00921e412/pr-13930

Create a PR, ensure that the CI is green. If it's not — update it so that
the tests and any other checks pass. This is it!
Now relax and wait for the maintainers to process your pull request
when they have some cycles to do reviews. Don't worry — they'll tell you if
any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

…ling (#13940) Co-authored-by: iamibi <8592115+iamibi@users.noreply.github.com> Fixes #123

…ling (#13942) Co-authored-by: iamibi <8592115+iamibi@users.noreply.github.com> Fixes #123

iamibi and others added 9 commits October 3, 2026 07:30

Add limits for client cookie handling

206bcb9

Co-authored-by: J. Nick Koston <nick@koston.org>

Simplify cookie limit bookkeeping in the cookie jar

4522489

Raise the per-domain cookie limit to 180

8f403bb

Evict cookies the way Firefox does

a019ca2

Simplify cookie eviction and tighten cookie docs

2c9ac5d

Load cookies through the normal eviction path

fb68d9f

Drop the old expiry when a cookie is replaced without one

b3cc2a8

Restore the upstream expiration heap handling

33a96b4

Correct cookie limit docs and comments

5f4605f

pyba-chronographer Bot added the bot:chronographer:provided There is a change note present in this PR label Oct 3, 2026

agentscanapp Bot added the agentscan:mixed-signals label Oct 3, 2026

pyba-chronographer Bot added the bot:chronographer:provided There is a change note present in this PR label Oct 3, 2026

github-actions Bot added the agentscan:mixed-signals label Oct 3, 2026

Split the unserializable morsel test by case

c860f53

bdraco removed the agentscan:mixed-signals label Oct 3, 2026

github-advanced-security Bot found potential problems Oct 3, 2026

View reviewed changes

Comment thread tests/test_cookiejar.py Fixed

bdraco added 2 commits October 3, 2026 08:15

Skip the control character morsel test with skipif

ded708c

Cover the remaining cookie limit branches

6ff4cfe

bdraco added 5 commits October 3, 2026 08:24

Rename changelog fragments to the PR number

261102c

Send host cookies first and unquote cookie attribute values

69c08b7

Restore the illegal cookie name warning and note the parser change

5966c57

Combine the bugfix changelog fragments

06188ac

Assert the parser behavior in stale cookie helper tests

ffae4f9

Log evicted cookies at debug level

16a180b

bdraco marked this pull request as ready for review October 3, 2026 19:40

Check the cookie jar bookkeeping against its contents

bcde497

Dreamsorcerer reviewed Oct 4, 2026

View reviewed changes

Comment thread THREAT_MODEL.md

Dreamsorcerer reviewed Oct 4, 2026

View reviewed changes

Comment thread tests/test_cookiejar.py Outdated

bdraco added 2 commits October 4, 2026 13:59

Leave the threat model update for a later PR

fd4ee47

Expect filter_cookies to leave the cookie storage untouched

e41e211

bdraco merged commit b1f6c87 into master Oct 4, 2026
57 checks passed

bdraco deleted the cookie_limits branch October 4, 2026 19:24

This was referenced Oct 4, 2026

[PR #13930/b1f6c87b backport][3.15] Add limits for client cookie handling #13940

Merged

[PR #13637/1857e6df backport][3.14] Fix mutable morsels #13941

Merged

bdraco added a commit that referenced this pull request Oct 4, 2026

[PR #13930/b1f6c87b backport][3.15] Add limits for client cookie hand…

3edb468

…ling (#13940) Co-authored-by: iamibi <8592115+iamibi@users.noreply.github.com> Fixes #123

bdraco mentioned this pull request Oct 4, 2026

[PR #13930/b1f6c87b backport][3.14] Add limits for client cookie handling #13942

Merged

5 tasks done

bdraco added a commit that referenced this pull request Oct 4, 2026

[PR #13930/b1f6c87b backport][3.14] Add limits for client cookie hand…

6963ee0

…ling (#13942) Co-authored-by: iamibi <8592115+iamibi@users.noreply.github.com> Fixes #123

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

bdraco commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What do these changes do?

Are there changes in behavior for the user?

Is it a substantial burden for the maintainers to support this?

Related issue number

Checklist

Uh oh!

agentscanapp Bot commented Oct 3, 2026

Mixed activity

Uh oh!

codecov Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

aiolibsbot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aiolibsbot commented Oct 3, 2026

Uh oh!

aiolibsbot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bdraco commented Oct 3, 2026

Uh oh!

bdraco commented Oct 3, 2026

Uh oh!

aiolibsbot commented Oct 3, 2026

Uh oh!

aiolibsbot commented Oct 3, 2026

Uh oh!

aiolibsbot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bdraco commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bdraco commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bdraco commented Oct 4, 2026

Uh oh!

aiolibsbot commented Oct 4, 2026

Uh oh!

aiolibsbot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review — Add limits for client cookie handling

Checklist

Silent Failure Analysis

Uh oh!

Uh oh!

Uh oh!

bdraco commented Oct 4, 2026

Uh oh!

bdraco commented Oct 4, 2026

Uh oh!

Uh oh!

patchback Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to 3.15: 💔 cherry-picking failed — conflicts found

Backporting merged PR #13930 into master

Uh oh!

patchback Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backport to 3.14: 💔 cherry-picking failed — conflicts found

Backporting merged PR #13930 into master

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

bdraco commented Oct 3, 2026 •

edited

Loading

codecov Bot commented Oct 3, 2026 •

edited

Loading

aiolibsbot commented Oct 3, 2026 •

edited

Loading

aiolibsbot commented Oct 3, 2026 •

edited

Loading

aiolibsbot commented Oct 3, 2026 •

edited

Loading

bdraco commented Oct 3, 2026 •

edited

Loading

bdraco commented Oct 4, 2026 •

edited

Loading

aiolibsbot commented Oct 4, 2026 •

edited

Loading

patchback Bot commented Oct 4, 2026 •

edited

Loading

patchback Bot commented Oct 4, 2026 •

edited

Loading