http.cookies —- HTTP状态管理

源代码:Lib/http/cookies.py

The http.cookies module defines classes for abstracting the concept ofcookies, an HTTP state management mechanism. It supports both simple string-onlycookies, and provides an abstraction for having any serializable data-type ascookie value.

The module formerly strictly applied the parsing rules described in theRFC 2109 and RFC 2068 specifications. It has since been discovered thatMSIE 3.0x doesn't follow the character rules outlined in those specs and alsomany current day browsers and servers have relaxed parsing rules when comes toCookie handling. As a result, the parsing rules used are a bit less strict.

The character set, string.ascii_letters, string.digits and!#$%&'*+-.^_`|~: denote the set of valid characters allowed by this modulein Cookie name (as key).

在 3.3 版更改: Allowed ':' as a valid Cookie name character.

注解

On encountering an invalid cookie, CookieError is raised, so if yourcookie data comes from a browser you should always prepare for invalid dataand catch CookieError on parsing.

  • exception http.cookies.CookieError

  • Exception failing because of RFC 2109 invalidity: incorrect attributes,incorrect Set-Cookie header, etc.

  • class http.cookies.BaseCookie([input])

  • This class is a dictionary-like object whose keys are strings and whose valuesare Morsel instances. Note that upon setting a key to a value, thevalue is first converted to a Morsel containing the key and the value.

If input is given, it is passed to the load() method.

  • class http.cookies.SimpleCookie([input])
  • This class derives from BaseCookie and overrides value_decode()and value_encode(). SimpleCookie supports strings as cookie values.When setting the value, SimpleCookie calls the builtin str() to convertthe value to a string. Values received from HTTP are kept as strings.

参见

  • Module http.cookiejar

  • HTTP cookie handling for web clients. The http.cookiejar andhttp.cookies modules do not depend on each other.

  • RFC 2109 - HTTP State Management Mechanism

  • This is the state management specification implemented by this module.

Cookie 对象

  • BaseCookie.valuedecode(_val)

  • Return a tuple (real_value, coded_value) from a string representation.real_value can be any type. This method does no decoding inBaseCookie —- it exists so it can be overridden.

  • BaseCookie.valueencode(_val)

  • Return a tuple (realvalue, coded_value). _val can be any type, butcoded_value will always be converted to a string.This method does no encoding in BaseCookie —- it exists so it canbe overridden.

In general, it should be the case that value_encode() andvalue_decode() are inverses on the range of value_decode.

  • BaseCookie.output(attrs=None, header='Set-Cookie:', sep='\r\n')

  • Return a string representation suitable to be sent as HTTP headers. attrs andheader are sent to each Morsel's output() method. sep is usedto join the headers together, and is by default the combination '\r\n'(CRLF).

  • BaseCookie.jsoutput(_attrs=None)

  • Return an embeddable JavaScript snippet, which, if run on a browser whichsupports JavaScript, will act the same as if the HTTP headers was sent.

The meaning for attrs is the same as in output().

  • BaseCookie.load(rawdata)
  • If rawdata is a string, parse it as an HTTP_COOKIE and add the valuesfound there as Morsels. If it is a dictionary, it is equivalent to:
  1. for k, v in rawdata.items():
  2.     cookie[k] = v

Morsel 对象

  • class http.cookies.Morsel
  • Abstract a key/value pair, which has some RFC 2109 attributes.

Morsels are dictionary-like objects, whose set of keys is constant —- the validRFC 2109 attributes, which are

  • expires

  • path

  • comment

  • domain

  • max-age

  • secure

  • version

  • httponly

  • samesite

The attribute httponly specifies that the cookie is only transferredin HTTP requests, and is not accessible through JavaScript. This is intendedto mitigate some forms of cross-site scripting.

The attribute samesite specifies that the browser is not allowed tosend the cookie along with cross-site requests. This helps to mitigate CSRFattacks. Valid values for this attribute are "Strict" and "Lax".

The keys are case-insensitive and their default value is ''.

在 3.5 版更改: eq() now takes key and valueinto account.

在 3.7 版更改: Attributes key, value andcoded_value are read-only. Use set() forsetting them.

在 3.8 版更改: Added support for the samesite attribute.

  • Morsel.value

  • Cookie的值。

  • Morsel.coded_value

  • The encoded value of the cookie —- this is what should be sent.

  • Morsel.key

  • The name of the cookie.

  • Morsel.set(key, value, coded_value)

  • Set the key, value and coded_value attributes.

  • Morsel.isReservedKey(K)

  • Whether K is a member of the set of keys of a Morsel.

  • Morsel.output(attrs=None, header='Set-Cookie:')

  • Return a string representation of the Morsel, suitable to be sent as an HTTPheader. By default, all the attributes are included, unless attrs is given, inwhich case it should be a list of attributes to use. header is by default"Set-Cookie:".

  • Morsel.jsoutput(_attrs=None)

  • Return an embeddable JavaScript snippet, which, if run on a browser whichsupports JavaScript, will act the same as if the HTTP header was sent.

The meaning for attrs is the same as in output().

  • Morsel.OutputString(attrs=None)
  • Return a string representing the Morsel, without any surrounding HTTP orJavaScript.

The meaning for attrs is the same as in output().

  • Morsel.update(values)
  • Update the values in the Morsel dictionary with the values in the dictionaryvalues. Raise an error if any of the keys in the values dict is not avalid RFC 2109 attribute.

在 3.5 版更改: an error is raised for invalid keys.

  • Morsel.copy(value)
  • Return a shallow copy of the Morsel object.

在 3.5 版更改: return a Morsel object instead of a dict.

  • Morsel.setdefault(key, value=None)
  • Raise an error if key is not a valid RFC 2109 attribute, otherwisebehave the same as dict.setdefault().

示例

The following example demonstrates how to use the http.cookies module.

  1. >>> from http import cookies
  2. >>> C = cookies.SimpleCookie()
  3. >>> C["fig"] = "newton"
  4. >>> C["sugar"] = "wafer"
  5. >>> print(C) # generate HTTP headers
  6. Set-Cookie: fig=newton
  7. Set-Cookie: sugar=wafer
  8. >>> print(C.output()) # same thing
  9. Set-Cookie: fig=newton
  10. Set-Cookie: sugar=wafer
  11. >>> C = cookies.SimpleCookie()
  12. >>> C["rocky"] = "road"
  13. >>> C["rocky"]["path"] = "/cookie"
  14. >>> print(C.output(header="Cookie:"))
  15. Cookie: rocky=road; Path=/cookie
  16. >>> print(C.output(attrs=[], header="Cookie:"))
  17. Cookie: rocky=road
  18. >>> C = cookies.SimpleCookie()
  19. >>> C.load("chips=ahoy; vienna=finger") # load from a string (HTTP header)
  20. >>> print(C)
  21. Set-Cookie: chips=ahoy
  22. Set-Cookie: vienna=finger
  23. >>> C = cookies.SimpleCookie()
  24. >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
  25. >>> print(C)
  26. Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
  27. >>> C = cookies.SimpleCookie()
  28. >>> C["oreo"] = "doublestuff"
  29. >>> C["oreo"]["path"] = "/"
  30. >>> print(C)
  31. Set-Cookie: oreo=doublestuff; Path=/
  32. >>> C = cookies.SimpleCookie()
  33. >>> C["twix"] = "none for you"
  34. >>> C["twix"].value
  35. 'none for you'
  36. >>> C = cookies.SimpleCookie()
  37. >>> C["number"] = 7 # equivalent to C["number"] = str(7)
  38. >>> C["string"] = "seven"
  39. >>> C["number"].value
  40. '7'
  41. >>> C["string"].value
  42. 'seven'
  43. >>> print(C)
  44. Set-Cookie: number=7
  45. Set-Cookie: string=seven