Cookie filter

aiohttp/client.py

@@ -7,6 +7,7 @@
 import sys
 import traceback
 import warnings
+import re
 import http.cookies
 import urllib.parse
 
@@ -24,6 +25,8 @@
 
 PY_35 = sys.version_info >= (3, 5)
 
+IPV4_PATTERN = re.compile(r"(\d{1,3}\.){3}\d{1,3}")
+
 
 class ClientSession:
     """First-class interface for making HTTP requests."""
@@ -172,10 +175,13 @@ def _request(self, method, url, *,
                 skip_headers.add(upstr(i))
 
         while True:
+
+            cookies = self._filter_cookies(url)
+
             req = self._request_class(
                 method, url, params=params, headers=headers,
                 skip_auto_headers=skip_headers, data=data,
-                cookies=self.cookies, encoding=encoding,
+                cookies=cookies, encoding=encoding,
                 auth=auth, version=version, compress=compress, chunked=chunked,
                 expect100=expect100,
                 loop=self._loop, response_class=self._response_class)
@@ -353,10 +359,58 @@ def _update_cookies(self, cookies):
             if isinstance(value, http.cookies.Morsel):
                 # use dict method because SimpleCookie class modifies value
                 # before Python 3.4
+                domain = value["domain"]
+                if domain.startswith("."):
+                    value["domain"] = domain[1:]
                 dict.__setitem__(self.cookies, name, value)
             else:
                 self.cookies[name] = value
 
+    def _filter_cookies(self, url):
+        """Returns this session's cookies filtered by their attributes"""
+        # TODO: filter by 'expires', 'path', ...
+        netloc = urllib.parse.urlsplit(url).netloc
+        is_ip = IPV4_PATTERN.match(netloc) is not None
+
+        filtered = http.cookies.SimpleCookie()
+
+        for name, morsel in self.cookies.items():
+            morsel_domain = morsel["domain"]
+
+            if is_ip and morsel_domain:
+                # not requesting from a domain, don't send cookies that aren't shared
+                continue
+
+            # Copy cookies with matching or empty (shared) domain
+            if not morsel_domain or self._is_domain_match(morsel_domain, netloc):
+                filtered[name] = morsel
+
+        return filtered
+
+    @staticmethod
+    def _is_domain_match(domain_string, string):
+        """Implements domain matching according to RFC 6265"""
+        if domain_string == string:
+            return True
+
+        if not string.endswith(domain_string):
+            return False
+
+        rest = string[:-len(domain_string)]
+
+        if not rest:
+            return False
+
+        if rest[-1] != ".":
+            return False
+
+        netloc = urllib.parse.urlsplit(string).netloc
+        is_ip = IPV4_PATTERN.match(netloc) is not None
+        if is_ip:
+            return False
+
+        return True
+
     def _prepare_headers(self, headers):
         """ Add default headers and transform it to CIMultiDict
         """

tests/test_client_session.py

@@ -3,10 +3,12 @@
 import gc
 import re
 import types
+import http.cookies
 from unittest import mock
 
 import aiohttp
 import pytest
+from aiohttp import test_utils
 from aiohttp.client import ClientSession
 from aiohttp.connector import BaseConnector, TCPConnector
 from aiohttp.multidict import CIMultiDict, MultiDict
@@ -368,3 +370,97 @@ def test_request_ctx_manager_props(loop):
         assert isinstance(ctx_mgr.gi_frame, types.FrameType)
         assert not ctx_mgr.gi_running
         assert isinstance(ctx_mgr.gi_code, types.CodeType)
+
+
+@pytest.fixture
+def get_with_cookies(create_session):
+    cookie_string = """
+        shared-cookie=first;
+        domain-cookie=second; domain=example.com;
+        subdomain1-cookie=third; domain=test1.example.com;
+        subdomain2-cookie=fourth; domain=test2.example.com;
+        dotted-domain-cookie=fifth; domain=.example.com;
+        different-domain-cookie=sixth; domain=different.org;
+        """
+
+    err = NotImplementedError()
+
+    req = mock.Mock()
+    req_factory = mock.Mock(return_value=req)
+
+    req.send = mock.Mock(side_effect=err)
+
+    session = create_session(
+        request_class=req_factory,
+        cookies=http.cookies.SimpleCookie(cookie_string))
+
+    @asyncio.coroutine
+    def create_connection(req):
+        # return self.transport, self.protocol
+        return mock.Mock(), mock.Mock()
+    session._connector._create_connection = create_connection
+
+    return session.get, req_factory
+
+
+@pytest.fixture
+def send_cookie_request(get_with_cookies):
+    get, req = get_with_cookies
+
+    @asyncio.coroutine
+    def maker(*args, **kwargs):
+        with pytest.raises(NotImplementedError):
+            yield from get(*args, **kwargs)
+
+        cookies = req.call_args[1]["cookies"]
+        return cookies
+    return maker
+
+
+@pytest.mark.run_loop
+def test_cookie_domain_filter_ip(send_cookie_request):
+    cookies = yield from send_cookie_request("http://1.2.3.4/")
+    assert set(cookies.keys()) == {
+        "shared-cookie"
+    }
+
+
+@pytest.mark.run_loop
+def test_cookie_domain_filter_same_host(send_cookie_request):
+    cookies = yield from send_cookie_request("http://example.com/")
+    assert set(cookies.keys()) == {
+        "shared-cookie",
+        "domain-cookie",
+        "dotted-domain-cookie"
+    }
+
+
+@pytest.mark.run_loop
+def test_cookie_domain_filter_same_host_and_subdomain(send_cookie_request):
+    cookies = yield from send_cookie_request("http://test1.example.com/")
+    assert set(cookies.keys()) == {
+        "shared-cookie",
+        "domain-cookie",
+        "subdomain1-cookie",
+        "dotted-domain-cookie"
+    }
+
+
+@pytest.mark.run_loop
+def test_cookie_domain_filter_same_host_different_subdomain(send_cookie_request):
+    cookies = yield from send_cookie_request("http://different.example.com/")
+    assert set(cookies.keys()) == {
+        "shared-cookie",
+        "domain-cookie",
+        "dotted-domain-cookie"
+    }
+
+
+@pytest.mark.run_loop
+def test_cookie_domain_filter_different_host(send_cookie_request):
+    cookies = yield from send_cookie_request("http://different.org/")
+    assert set(cookies.keys()) == {
+        "shared-cookie",
+        "different-domain-cookie"
+    }
+