Activate session_filter makes the quickstarted test_controllers tests fails

[cdevienne]

On a quickstarted TG 1.1 project with identity:

• adding session_filter.on = True in app.cfg
• run the test_controllers.py tests

-> AssertionError?: Bad header value: 'session_id=bb5e49bea3dd167a819cc3463d7b8182f2734d99; expires=Tue, 09 Mar 2010 18:06:48 GMT; Path=/\r' (bad char: '\r')

The problems occurs when multiple cookies (in that case : session_id an tg-visit) are in the response : a "\r" seems to be added between the two cookies.

I could not find a workaround.

It may be related to #2446.

[cdevienne]

Sorry for answering myself, but I found a way to fix the problem, by patching cherrypy...

in cherrypy/_cphttptools.py, around at line 434 :

432 if cookie: 433 for line in cookie.split("\n"): 434 name, value = line.split(": ", 1) 435 self.header_list.append((name, value))

with :

432 if cookie: 433 for line in cookie.split("\n"): 434 name, value = line.strip('\r').split(": ", 1) 435 self.header_list.append((name, value))

solved the issue.

Now I am not sure it is ideal, nor if we could make this go into a bugfix release of CherryPy?.

[cdevienne]

Same one with correct formatting.

432 if cookie: 
433     for line in cookie.split("\n"): 
434         name, value = line.split(": ", 1)
435         self.header_list.append((name, value))

with :

432 if cookie: 
433     for line in cookie.split("\n"): 
434         name, value = line.strip('\r').split(": ", 1) 
435         self.header_list.append((name, value)) 

[cdevienne]

Another way to fix the problem, still in cherrypy/_cphttptools.py. Replace :

431         cookie = self.simple_cookie.output()

with :

431         cookie = self.simple_cookie.output(sep='\n')

[cdevienne]

The original problem probably comes from the BaseCookie.output function which changed its default separator in python 2.5 :

 http://docs.python.org/library/cookie.html#Cookie.BaseCookie.output

I guess we should do a bug report to CherryPy since it can be considered as a python 2.5 regression, but can we really expect a bugfix release ?

In addition, here is a dirty monkey path that workaround this issue by reverting SimpleCookie.output to the python<2.5 behavior :

import Cookie

def output(self, attrs=None, header='Set-Cookie:', sep='\n'):
    return self._orig_output(attrs, header, sep)
 
Cookie.SimpleCookie._orig_output = Cookie.SimpleCookie.output
Cookie.SimpleCookie.output = output

[chrisz]

Your analysis is correct (#2446 is a separate issue with WebTest, not CherryPy), and I have already submitted a patch and request to the CheerryPy folks. If they won't fix it, maybe we can create our own CherryPy bugfix release or monkey-patch CherryPy (I prefer that to monkey-patching Cookie).

[chrisz]

The CherryPy folks are not supporting 2.x any longer, but they will set me up so I can create a bugfix release CherryPy 2.3.1 for the TurboGears 1.1 branch. We can then also fix the other known issues with CherryPy 2.3.0 on newer Python versions (I know of one, maybe there are more).

I keep this ticket open as a reminder to require the CherryPy bugfix release in TG 1.1.2. Since I don't know how quickly this can be done (depends on the CherryPy folks), and I don't want to postpone this any further, I'll release TG 1.1.1 without this change.

[faide]

Chris Z,

I also stumbled on the issue and see you have already "solved" it. Did you get access to cherrypy source?

Could we envision a simple maintenance release of CP2 with only this to correct?

[chrisz]

Felix is working on 2.3.1 already, see  here. I don't know why it's not making progress, you should ask him directly.

[chrisz]

Unfortunately, CP 2.3.1 has still not been released, but I'm closing this now anyway since it won't be fixed here.