Repository navigation
google's invalid g_state cookies cause aiohttp to stop parsing cookies after it #11632
Description
Describe the bug
google creates invalid g_state cookies (https://stackoverflow.com/questions/66864766/one-tap-login-g-state-cookie-is-not-parseable-on-http-cookies-simplecookie) which causes aiohttp._cookie_helpers.parse_cookie_header to not match on that key, and then break out and not return any more of the keys, and even worse without any warning.
To Reproduce
- Implement server with route that echos back cookies:
async def echo_cookies(self, req):
# Return the cookie names as parsed by aiohttp
return json_response({
'cookie_names': list(req.cookies.keys()),
'cookies': dict(req.cookies),
})- Use client to send cookies:
cookie_header = (
'_ga=ga; '
'ajs_anonymous_id=0anonymous; '
'analytics_session_id=session; '
'cookies-analytics=true; '
'cookies-functional=true; '
'cookies-marketing=true; '
'cookies-preferences=true; '
'g_state={"i_l":0,"i_ll":12345,"i_b":"blah"}; '
'analytics_session_id.last_access=1760128947692; '
'landingPageURLRaw=landingPageURLRaw; '
'landingPageURL=landingPageURL; '
'referrerPageURLRaw=; '
'referrerPageURL=; '
'formURLRaw=formURLRaw; '
'formURL=formURL; '
'fbnAuthExpressCheckout=fbnAuthExpressCheckout; '
'is_express_checkout=1; '
)
resp = await self.client.get('/echo-cookies', headers={'Cookie': cookie_header})
self.assertEqual(resp.status, 200)
data = await resp.json()note that everything after g_state is not returned.
Expected behavior
Given that presumably chrome can parse this, aiohttp should as well
Logs/tracebacks
g_state and everything after it is not returnedPython Version
Python 3.11.1aiohttp Version
Name: aiohttp
Version: 3.12.15
Summary: Async http client/server framework (asyncio)
Home-page: https://github.com/aio-libs/aiohttp
Author:
Author-email:
License: Apache-2.0 AND MIT
Location: /Users/alexmohr/.local/share/uv/venv/fbn.com/api/commodities/lib/python3.11/site-packages
Requires: aiohappyeyeballs, aiosignal, attrs, frozenlist, multidict, propcache, yarlmultidict Version
Name: multidict
Version: 6.6.4
Summary: multidict implementation
Home-page: https://github.com/aio-libs/multidict
Author: Andrew Svetlov
Author-email: andrew.svetlov@gmail.com
License: Apache License 2.0propcache Version
Name: propcache
Version: 0.3.2
Summary: Accelerated property cache
Home-page: https://github.com/aio-libs/propcache
Author: Andrew Svetlov
Author-email: andrew.svetlov@gmail.com
License: Apache-2.0yarl Version
Name: yarl
Version: 1.20.1
Summary: Yet another URL library
Home-page: https://github.com/aio-libs/yarl
Author: Andrew Svetlov
Author-email: andrew.svetlov@gmail.com
License: Apache-2.0OS
OSX 26.0.1 (25A362)
Related component
Server
Additional context
No response
Code of Conduct
- I agree to follow the aio-libs Code of Conduct
Activity
thehesiod commentedon Oct 10, 2025
I tested 3.13 after I saw #11112 however it does not fix the issue. Note that the above test is from our real world server with official google integration
Dreamsorcerer commentedon Oct 14, 2025
Any chance you could make an xfail test in a PR? Maybe @bdraco wants to check this one too, following that previous PR.
thehesiod commentedon Oct 14, 2025
@Dreamsorcerer #11651.
thehesiod commentedon Oct 14, 2025
btw not sure why that pr is failing, it simply adds a test, doesn't seem like it needs any documentation
thehesiod commentedon Oct 14, 2025
btw verified it works in node:
thehesiod commentedon Oct 14, 2025
3.15a1 does not seem to fix this issue btw
Ensure cookies are still parsed after a malformed cookie
thehesiod commentedon Oct 29, 2025
appreciate the fix! rolling this in our product, seems to work well!