boring-http 2.0.1__tar.gz → 2.0.3__tar.gz

{boring_http-2.0.1 → boring_http-2.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.0.1
+Version: 2.0.3
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
 Requires-Dist: boring-ssl2>=1.2.0
 Requires-Dist: ssl2>=2.0.1
@@ -70,7 +70,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
+`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. A `Domain` that is a public suffix on the bundled Public Suffix List, such as `co.uk` or `github.io`, is refused unless it is the host itself, which then keeps the cookie to that host. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
 
 ## Streaming and timeouts
 
@@ -98,7 +98,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
+A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
 ## HTTP/3
 
@@ -453,7 +453,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen.
+Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
 
 ## uvloop
 

{boring_http-2.0.1 → boring_http-2.0.3}/README.md

@@ -60,7 +60,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
+`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. A `Domain` that is a public suffix on the bundled Public Suffix List, such as `co.uk` or `github.io`, is refused unless it is the host itself, which then keeps the cookie to that host. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
 
 ## Streaming and timeouts
 
@@ -88,7 +88,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
+A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
 ## HTTP/3
 
@@ -443,7 +443,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen.
+Over HTTP/1.1 this is the Upgrade handshake. Over HTTP/2 and HTTP/3 it is Extended CONNECT when the server advertises `SETTINGS_ENABLE_CONNECT_PROTOCOL`, otherwise the client opens an HTTP/1.1 connection for it. `subprotocols=[...]` offers subprotocols; `websocket.subprotocol` is the one chosen. The `total` of `timeout` covers the handshake only; afterwards `read` and `write` still limit each wait, so `Timeout(read=None)` lets `receive()` wait through any silence.
 
 ## uvloop
 

{boring_http-2.0.1 → boring_http-2.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.1"
+version = "2.0.3"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.1 → boring_http-2.0.3}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.1"
+version = "2.0.3"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.1 → boring_http-2.0.3}/src/boring_http/cookies.py

@@ -4,6 +4,16 @@ from dataclasses import dataclass
 from email.utils import parsedate_to_datetime
 from typing import Self
 
+from boring_http.public_suffixes import EXCEPTIONS, RULES
+
+
+def is_public_suffix(domain: str) -> bool:
+    # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
+    if domain in EXCEPTIONS:
+        return False
+    parent = domain.partition(".")[2]
+    return domain in RULES or f"*.{parent}" in RULES or not parent
+
 
 @dataclass(frozen=True, slots=True)
 class Cookie:
@@ -46,6 +56,11 @@ class Cookie:
                     pass
         if domain and not (host == domain or host.endswith("." + domain)):
             return None
+        # RFC 6265 section 5.3 step 5: a public suffix as Domain is refused, unless it is the host itself, which keeps the cookie to that host
+        if domain and is_public_suffix(domain):
+            if domain != host:
+                return None
+            domain = ""
         if not path.startswith("/"):
             path = request_path[: request_path.rfind("/")] or "/"
         return cls(

{boring_http-2.0.1 → boring_http-2.0.3}/src/boring_http/pool.py

@@ -68,7 +68,8 @@ class Pool:
                 await limit.acquire()
                 await self._total.acquire()
             try:
-                connection = await self._connector(url, proxy, quic)
+                async with deadline.phase("connect"):
+                    connection = await self._connector(url, proxy, quic)
             except BaseException:
                 limit.release()
                 self._total.release()