boring-http 2.0.2__tar.gz → 2.0.3__tar.gz

{boring_http-2.0.2 → boring_http-2.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.0.2
+Version: 2.0.3
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
 Requires-Dist: boring-ssl2>=1.2.0
 Requires-Dist: ssl2>=2.0.1
@@ -70,7 +70,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
+`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. A `Domain` that is a public suffix on the bundled Public Suffix List, such as `co.uk` or `github.io`, is refused unless it is the host itself, which then keeps the cookie to that host. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
 
 ## Streaming and timeouts
 

{boring_http-2.0.2 → boring_http-2.0.3}/README.md

@@ -60,7 +60,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
+`response.cookies` holds only the cookies this response set; `client.cookies` is the jar that follows every request. A `Domain` that is a public suffix on the bundled Public Suffix List, such as `co.uk` or `github.io`, is refused unless it is the host itself, which then keeps the cookie to that host. `location`, `content_type`, `charset`, `content_length`, `content_encoding`, `retry_after`, `etag`, `last_modified` and `date` are parsed, `response.headers` keeps the raw fields in order, `raise_for_status()` raises `HTTPStatusError`.
 
 ## Streaming and timeouts
 

{boring_http-2.0.2 → boring_http-2.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.2"
+version = "2.0.3"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.2 → boring_http-2.0.3}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.2"
+version = "2.0.3"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.2 → boring_http-2.0.3}/src/boring_http/cookies.py

@@ -4,6 +4,16 @@ from dataclasses import dataclass
 from email.utils import parsedate_to_datetime
 from typing import Self
 
+from boring_http.public_suffixes import EXCEPTIONS, RULES
+
+
+def is_public_suffix(domain: str) -> bool:
+    # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
+    if domain in EXCEPTIONS:
+        return False
+    parent = domain.partition(".")[2]
+    return domain in RULES or f"*.{parent}" in RULES or not parent
+
 
 @dataclass(frozen=True, slots=True)
 class Cookie:
@@ -46,6 +56,11 @@ class Cookie:
                     pass
         if domain and not (host == domain or host.endswith("." + domain)):
             return None
+        # RFC 6265 section 5.3 step 5: a public suffix as Domain is refused, unless it is the host itself, which keeps the cookie to that host
+        if domain and is_public_suffix(domain):
+            if domain != host:
+                return None
+            domain = ""
         if not path.startswith("/"):
             path = request_path[: request_path.rfind("/")] or "/"
         return cls(