Make request.COOKIES a MultiValueDict or QueryDict
- Dominant language
- No language data
- Stars
- 188
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
### Code of Conduct
- [x] I agree to follow Django's Code of Conduct
### Feature Description
In short, let `request.COOKIES` map keys to *multiple* values, by using a `MultiValueDict` or `QueryDict` like approach.
### Problem
Cookies are a header where names map on values. Just like the querystring and request payload, there is no guarantee that a name occurs once. In fact if a hacker manages to enter a cookie by a compromised subdomain, one can have two or more cookies with the same name.
Currently the behavior is that the browser somehow determines an order, and that Django will pick the last value assigned, since it enumerates over the cookies.
As part of a security measure, it might make sense to pass the cookies as a `MultiValueDict` like object, such that one can reject the request in case the session id, csrf token occurs multiple times.
It would also give the web developer more freedom to determine which of the values of a cookie is used.
Another option is to define a property that passes the cookies as a `MultiValueDict`.
### Request or proposal
request
### Additional Details
_No response_
### Implementation Suggestions
This can probably be done fairly simple with:
```python
from django.utils.datastructures import MultiValueDict
def parse_cookie(cookie):
"""
Return a dictionary parsed from a `Cookie:` header string.
"""
cookiedict = MultiValueDict()
for chunk in cookie.split(";"):
if "=" in chunk:
key, val = chunk.split("=", 1)
else:
# Assume an empty name per
# https://bugzilla.mozilla.org/show_bug.cgi?id=169091
key, val = "", chunk
key, val = key.strip(), val.strip()
if key or val:
# unquote using Python's algorithm.
cookiedict.appendlist(key, cookies._unquote(val))
return cookiedict
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating Django's request.COOKIES construction and the existing parse_cookie entry point. Compare the current cookie parsing behavior with MultiValueDict or QueryDict, then add coverage for duplicate cookie names. Done means multiple values are preserved while existing single-cookie behavior remains covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100