http.cookies: parser accepts key characters that Morsel.set then rejects

Bug report

Bug description:

SimpleCookie.load() extracts cookie names using _LegalKeyChars, which deliberately admits characters RFC 6265 forbids in a token — the comment above it cites MSIE non-compliance as the reason. Morsel.set() then validates with _is_legal_key, built from _LegalChars, which excludes them. Twelve separator characters differ, so any Set-Cookie whose name contains one raises CookieError even though the module's own parser accepted it.

Encountered in the wild: F5 BIG-IP load balancers emit a persistence cookie named for the partition path, /Common/.app/--pool. Browsers accept this...

from http.cookies import SimpleCookie
SimpleCookie('/a/b=1')      # also a@b=1, a,b=1, a(b)=1

CPython versions tested on:

3.14

Operating systems tested on:

Linux

L’issue mentionne SimpleCookie.load(), Morsel.set(), _LegalKeyChars, _is_legal_key et _LegalChars ; commencez par suivre ces chemins du parser et de validation et reproduire les noms de cookies indiqués. Le travail est terminé lorsque le comportement des noms acceptés est cohérent, que les exemples ne lèvent plus CookieError et qu’une couverture de régression existe pour cette incohérence.