Is it possible to modify the request header cookies before cherrypy tries to load those cookies?

[debo07]

Recently we upgraded our legacy cherrypy-8.1 to 18.3 along with python-3 upgrade. Post upgrade, we are facing an issue with a cookie. Cookie value has space and comma, I believe this is not allowed as per RFC-6562.
However, this cookie is set at parent domain (e.g. set for .domain.com) by a third party cookie consent script and my app runs at subdomain.domain.com. So, in chrome it sends all the cookies(including the one which is not set by my application) in the request header(which is not the case for Firefox). This cookie has a long expiry.
What I am trying to do is intercept the request header cookie string and if it has space(" "), replace it by empty string("") before cherrypy could load the cookies. In that case, it should not break silently in cherrypy layer.

Trying to understand, what is the hook on my application side where I can modify the incoming cookie! I have tried doing this in on_start_resource hook, but didn't work for me.

class CookieModifierTool(cherrypy.Tool):
    def __init__(self):
        cherrypy.Tool.__init__(self, 'on_start_resource',
                               self.modify_cookie,
                               priority=30)

    def modify_cookie(self):
        cookie_header = cherrypy.request.headers.get("Cookie")
        Log.info('Request Cookie header string = %s', cookie_header)
        if cookie_header:
            modified_cookie_header = cookie_header.replace(" ", "")
            cherrypy.request.headers["Cookie"] = modified_cookie_header
        updated_cookie_header = cherrypy.request.headers.get("Cookie")
        Log.info('Request Cookie header string = %s', updated_cookie_header)
        request_cookies = cherrypy.request.cookie
        Log.info('Checking direct cookie value of direct session id = %s', request_cookies.get('session_id'))
        Log.info('Checking direct cookie value of cmapi_cookie_privacy = %s', request_cookies.get('cmapi_cookie_privacy'))

cherrypy.tools.modify_cookie = CookieModifierTool()

And in the config, I added this -

config = {
    "global": {
        "tools.modify_cookie.on": True,
        ....
    },
    "/": {...}
}

[webknjaz]

https://docs.cherrypy.dev/en/latest/extend.html#hook-point:

“on_start_resource” - The earliest hook; the Request-Line and request headers have been processed and a dispatcher has set request.handler and request.config.

So I think it's too late.

Also, HTTP parsing happens in Cheroot, a layer below CherryPy. I don't think you can easily mess with the HTTP parser there.

[debo07]

https://docs.cherrypy.dev/en/latest/extend.html#hook-point:

“on_start_resource” - The earliest hook; the Request-Line and request headers have been processed and a dispatcher has set request.handler and request.config.

So I think it's too late.

You are right. My bad, I just looked at the "The earliest hook" part and didn't notice the part where it was mentioned that "request headers have been processed".

I don't see where it could happen in https://github.com/cherrypy/cheroot/blob/4664602/cheroot/server.py#L183-L248 so maybe it's indeed on the CherryPy side. Someone needs to stick a debugger there and figure out what's happening.

I thought this is happening here at cherryPy - https://github.com/cherrypy/cherrypy/blob/main/cherrypy/_cprequest.py#L734

While trying out things, I tried updating the request cookie directly rather than just headers, which worked for me. Something like below -

def modify_cookie(self):
        cookie_header = cherrypy.request.headers.get("Cookie")
        Log.info('Request Cookie header string = %s', cookie_header)
        if cookie_header:
            modified_cookie_header = cookie_header.replace(" ", "")
            cherrypy.request.headers["Cookie"] = modified_cookie_header
            # Parse the modified cookie header manually
            parsed_cookies = cookies.SimpleCookie()
            parsed_cookies.load(modified_cookie_header)
            # Update the cherrypy.request.cookie object with the modified cookies
            cherrypy.request.cookie = parsed_cookies
        updated_cookie_header = cherrypy.request.headers.get("Cookie")
        Log.info('Request Cookie header string = %s', updated_cookie_header)
        request_cookies = cherrypy.request.cookie
        Log.info('Checking direct cookie value of direct session id = %s', request_cookies.get('session_id'))
        Log.info('Checking direct cookie value of cmapi_cookie_privacy = %s', request_cookies.get('cmapi_cookie_privacy'))

This worked but this doesn't seem to be right approach to update request cookie on my application side.
@webknjaz What's your opinion on this?

[webknjaz]

Oh, I thought you implied that the data doesn't reach your handler at all.
Yes, I think it's okay to modify the request in-place, if that's what you need.

[webknjaz]

Here's an example of a built-in tool deleting headers even:

cherrypy/cherrypy/lib/cptools.py

Lines 217 to 230 in c4bd17a

	def ignore_headers(headers=('Range',), debug=False):
	"""Delete request headers whose field names are included in 'headers'.
	This is a useful tool for working behind certain HTTP servers;
	for example, Apache duplicates the work that CP does for 'Range'
	headers, and will doubly-truncate the response.
	"""
	request = cherrypy.serving.request
	for name in headers:
	if name in request.headers:
	if debug:
	cherrypy.log('Ignoring request header %r' % name,
	'TOOLS.IGNORE_HEADERS')
	del request.headers[name]

[debo07]

Thanks a lot @webknjaz for confirming this.

Yes, data was reaching my handler and below is the final solution I have applied.

class CookieModifierTool(cherrypy.Tool):
    '''
        Modifying the request header cookie value if it has space.
      
    '''
    def __init__(self):
        cherrypy.Tool.__init__(self, 'on_start_resource',
                               self.modify_cookie,
                               priority=1)

    def modify_cookie(self):
        cookie_header = cherrypy.request.headers.get("Cookie")
        if cookie_header:
            modified_cookie_header = cookie_header.replace(" ", "")
            cherrypy.request.headers["Cookie"] = modified_cookie_header
            # Parse the modified cookie header manually
            parsed_cookies = cookies.SimpleCookie()
            parsed_cookies.load(modified_cookie_header)
            # Update the cherrypy.request.cookie object with the modified cookies
            cherrypy.request.cookie = parsed_cookies

cherrypy.tools.modify_cookie = CookieModifierTool()

config = {
    "global": {
        "tools.modify_cookie.on": True,
        ....
    },
    "/": {...}
}

Also, is there a need to use the thread local object cherrypy.serving.request in this custom tool or is it fine the way we accessed it directly cherrypy.request?

[webknjaz]

IIRC cherrypy.request is just an alias for convenience so both should work.

Regarding your snippet above, I have some comments.

Use super() — that syntax you got is from times of Python 2.4. We don't do that anymore, the modern idiom is

- cherrypy.Tool.__init__(self, 'on_start_resource',
-                                self.modify_cookie,
-                                priority=1)
+ super().__init__(
+     'on_start_resource',
+     self.modify_cookie,
+     priority=1,
+ )

Use guard expressions. By simply inverting one check, you can bail early and dedent a whole block of code.
```python
if not cookie_header:
    return

# the rest of lines here

Finally, it's customary to use double triple quotes for the docstrings. You might want to do that too.

P.S. Could you put the polished snippet version into a separate discussion reply and mark it as an answer?

[debo07]

Thanks @webknjaz for your review comments. :)
This is the final snippet as per your review comments. Hope this is fine, I'm just testing it out.

class CookieModifierTool(cherrypy.Tool):
    """
    Modifying the request header cookie value if it has space.
    """

    def __init__(self):
        super().__init__(
            'on_start_resource',
            self.modify_cookie,
            priority=1,
        )

    def modify_cookie(self):
        cookie_header = cherrypy.request.headers.get("Cookie")
        if not cookie_header:
            return
        modified_cookie_header = cookie_header.replace(" ", "")
        cherrypy.request.headers["Cookie"] = modified_cookie_header
        # Parse the modified cookie header manually
        parsed_cookies = cookies.SimpleCookie()
        parsed_cookies.load(modified_cookie_header)
        # Update the cherrypy.request.cookie object with the modified cookies
        cherrypy.request.cookie = parsed_cookies

cherrypy.tools.modify_cookie = CookieModifierTool()

config = {
    "global": {
        "tools.modify_cookie.on": True,
        ....
    },
    "/": {...}
}

[webknjaz]

Looks good!