Skip to content

[python] Set API key cookie as key-value pair #24149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wing328 merged 7 commits into from
Jul 10, 2026
Merged

[python] Set API key cookie as key-value pair #24149

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
94d808c
[python] Set API key cookie as key-value pair
rgroothuijsen Jun 28, 2026
d71c9ce
[python] Account for setting multiple cookies
rgroothuijsen Jun 28, 2026
bd13ed0
Quote API cookie value to avoid possible parsing issues
rgroothuijsen Jun 28, 2026
c552c8b
[python] Stringify and quote API key cookie value to avoid possible p…
rgroothuijsen Jun 28, 2026
07e3e01
[python] Limit cookie value URL-encoding to spaces and semicolons
rgroothuijsen Jun 28, 2026
38ff9d6
[python] Quote special cookie characters other than special base64 ch…
rgroothuijsen Jul 4, 2026
64003e5
[python] Quote special cookie characters using double quotes
rgroothuijsen Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion modules/openapi-generator/src/main/resources/python/api_client.mustache
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -680,7 +680,16 @@ class ApiClient:
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion ...ent/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -673,7 +673,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
Comment on lines +680 to +684

@cubic-dev-ai cubic-dev-ai Bot Jul 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Cookie authentication values that contain spaces, semicolons, commas, or backslashes can produce malformed Cookie headers after this change. The new block replaces urllib.parse.quote with simple double-quote wrapping, but Cookie header parsing typically splits on ; and , regardless of surrounding quotes, and raw control characters or non-ASCII bytes can cause request failures or header-injection issues. To safely handle special characters in generated cookie values, consider retaining percent-encoding (e.g. quote(str(auth_setting['value']), safe='+/=')) rather than relying on quoting alone.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py, line 680:

<comment>Cookie authentication values that contain spaces, semicolons, commas, or backslashes can produce malformed `Cookie` headers after this change. The new block replaces `urllib.parse.quote` with simple double-quote wrapping, but Cookie header parsing typically splits on `;` and `,` regardless of surrounding quotes, and raw control characters or non-ASCII bytes can cause request failures or header-injection issues. To safely handle special characters in generated cookie values, consider retaining percent-encoding (e.g. `quote(str(auth_setting['value']), safe='+/=')`) rather than relying on quoting alone.</comment>

<file context>
@@ -677,8 +677,11 @@ def _apply_auth_params(
                 headers['Cookie'] += "; "
-            # Account for cookie value containing spaces and special characters, excluding base64 delimiters
-            cookie_value = quote(str(auth_setting['value']), safe='+/=')
+            # Account for cookie value containing spaces and special characters
+            cookie_value = str(auth_setting['value'])
+            if not re.match("^\".*\"$", cookie_value):
</file context>
Suggested change
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
# Account for cookie value containing spaces and special characters, excluding base64 delimiters
cookie_value = quote(str(auth_setting['value']), safe='+/=')

headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion samples/client/echo_api/python/openapi_client/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -673,7 +673,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion samples/openapi3/client/petstore/python-aiohttp/petstore_api/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -675,7 +675,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion samples/openapi3/client/petstore/python-httpx-sync/petstore_api/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -675,7 +675,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion samples/openapi3/client/petstore/python-httpx/petstore_api/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -675,7 +675,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion samples/openapi3/client/petstore/python-lazyImports/petstore_api/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -672,7 +672,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
11 changes: 10 additions & 1 deletion samples/openapi3/client/petstore/python/petstore_api/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -672,7 +672,16 @@ def _apply_auth_params(
:param auth_setting: auth settings for the endpoint
"""
if auth_setting['in'] == 'cookie':
headers['Cookie'] = auth_setting['value']
if not 'Cookie' in headers:
headers['Cookie'] = ""
else:
headers['Cookie'] += "; "
# Account for cookie value containing spaces and special characters
cookie_value = str(auth_setting['value'])
if not re.match("^\".*\"$", cookie_value):
cookie_value = cookie_value.replace("\"", "\\\"")
cookie_value = f"\"{cookie_value}\""
headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
elif auth_setting['in'] == 'header':
if auth_setting['type'] != 'http-signature':
headers[auth_setting['key']] = auth_setting['value']
Expand Down
Loading