django / django/new-features

Make request.COOKIES a MultiValueDict or QueryDict

Open
#190 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
188
Forks
7
PR merge metrics
No merged PRs in 30d

Description

### Code of Conduct

- [x] I agree to follow Django's Code of Conduct

### Feature Description

In short, let `request.COOKIES` map keys to *multiple* values, by using a `MultiValueDict` or `QueryDict` like approach.

### Problem

Cookies are a header where names map on values. Just like the querystring and request payload, there is no guarantee that a name occurs once. In fact if a hacker manages to enter a cookie by a compromised subdomain, one can have two or more cookies with the same name.

Currently the behavior is that the browser somehow determines an order, and that Django will pick the last value assigned, since it enumerates over the cookies.

As part of a security measure, it might make sense to pass the cookies as a `MultiValueDict` like object, such that one can reject the request in case the session id, csrf token occurs multiple times.

It would also give the web developer more freedom to determine which of the values of a cookie is used.

Another option is to define a property that passes the cookies as a `MultiValueDict`.

### Request or proposal

request

### Additional Details

_No response_

### Implementation Suggestions

This can probably be done fairly simple with:

```python
from django.utils.datastructures import MultiValueDict

def parse_cookie(cookie):
"""
Return a dictionary parsed from a `Cookie:` header string.
"""
cookiedict = MultiValueDict()
for chunk in cookie.split(";"):
if "=" in chunk:
key, val = chunk.split("=", 1)
else:
# Assume an empty name per
# https://bugzilla.mozilla.org/show_bug.cgi?id=169091
key, val = "", chunk
key, val = key.strip(), val.strip()
if key or val:
# unquote using Python's algorithm.
cookiedict.appendlist(key, cookies._unquote(val))
return cookiedict
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating Django's request.COOKIES construction and the existing parse_cookie entry point. Compare the current cookie parsing behavior with MultiValueDict or QueryDict, then add coverage for duplicate cookie names. Done means multiple values are preserved while existing single-cookie behavior remains covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.