Allow CherryPy to ignore invalid cookies

[lgwozdecki]

I'm submitting a ...

• bug report
• feature request
• question about the decisions made in the repository

Do you want to request a feature or report a bug?
feature

What is the current behavior?
Whenever one of the cookies is invalid, CherryPy returns error 400
It is common for browsers and other web servers to support cookies that are not RCF compliant and users are expecting such cookies to work. If another website in the same domain is setting invalid cookie it will break the website served by CherryPy

If the current behavior is a bug, please provide the steps to reproduce and if possible a screenshots and logs of the problem. If you can, show us your code.
Set a cookie for the same domain using for example Chrome developer tools, for example:
__utmzz=utmcsr=(direct)|utmcmd=(none)|utmccn=(not set)|utmcct=(not set)|utmctr=(not set)|utmgclid=(not set)

What is the expected behavior?
CherryPy ignores invalid cookie

What is the motivation / use case for changing the behavior?
Website served by CherryPy should not be affected by another website in the same domain

Please tell us about your environment:

• Cheroot version: X.X.X
• CherryPy version: 18.1.2
• Python version: 3.7.11
• OS: MacOs
• Browser: [Chrome 105.0.5195.102, probably others too]

Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, e.g. stackoverflow, gitter, etc.)
Python standard library implementation of cookie parser (https://github.com/python/cpython/blob/3.7/Lib/http/cookies.py) assumes that cookies can be separated only by space but the standard requires semicolon and space between cookies

   cookie-header = "Cookie:" OWS cookie-string OWS
   cookie-string = cookie-pair *( ";" SP cookie-pair )

So it is treating the value after space and before “=” as new key and it is validating it against valid character for the token which can’t contain “(“ character:

   token          = 1*<any CHAR except CTLs or separators>
   separators     = "(" | ")" | "<" | ">" | "@"
                  | "," | ";" | ":" | "\" | <">
                  | "/" | "[" | "]" | "?" | "="
                  | "{" | "}" | SP | HT

Similar issue is logged in cpython: (python/cpython#75637)

and for example in Django they rewritten cookie parser to match browser behaviour:
(django/django@93a135d)

there are also some workarounds available like this:
(https://stackoverflow.com/questions/7148458/cookieerror-illegal-key-value#answer-25819605)

My proposed solution would be to update the _cprequest.py to ignore invalid cookies or to make raising error optional

723,726c723,727
<                 try:
<                     self.cookie.load(value)
<                 except CookieError as exc:
<                     raise cherrypy.HTTPError(400, str(exc))
---
>                 for bit in value.split(';'):
>                     try:
>                         self.cookie.load(bit)
>                     except CookieError as exc:
>                         pass