[3.13] gh-61366: Read session cookies written by curl and Wget (GH-11792) (GH-155605)

miss-islington · Rémi Lapeyre · serhiy-storchaka · web-flow · commit 4b79d9f5ffb5 · 2026-08-12T11:55:28.000+03:00
(cherry picked from commit e37cf49) Co-authored-by: Rémi Lapeyre <remi.lapeyre@henki.fr> Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
@@ -2053,7 +2053,8 @@ def _really_load(self, f, filename, ignore_discard, ignore_expires):
                 assert domain_specified == initial_dot
 
                 discard = False
-                if expires == "":
+                # curl and Wget set expires to 0 for session cookies.
+                if expires == "0" or expires == "":
                     expires = None
                     discard = True
 
diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
@@ -17,7 +17,7 @@
      CookieJar, DefaultCookiePolicy, LWPCookieJar, MozillaCookieJar,
      LoadError, lwp_cookie_str, DEFAULT_HTTP_PORT, escape_path,
      reach, is_HDN, domain_match, user_domain_match, request_path,
-     request_port, request_host)
+     request_port, request_host, NETSCAPE_HEADER_TEXT)
 
 mswindows = (sys.platform == "win32")
 
@@ -2041,6 +2041,34 @@ def test_session_cookies(self):
             # we didn't have session cookies in the first place
         self.assertNotEqual(counter["session_before"], 0)
 
+    def test_load_session_cookies(self):
+        # curl and Wget write 0 in the expires field for session cookies,
+        # while we write an empty field.  Both should be read (gh-61366).
+        filename = os_helper.TESTFN
+        self.addCleanup(os_helper.unlink, filename)
+        expires = int(time.time() + 3600)
+        with open(filename, "w") as f:
+            f.write(NETSCAPE_HEADER_TEXT)
+            f.write("www.foo.com\tFALSE\t/\tFALSE\t%u\tperm\tbar\n" % expires)
+            f.write("www.foo.com\tFALSE\t/\tFALSE\t0\tcurl_session\tbar\n")
+            f.write("www.foo.com\tFALSE\t/\tFALSE\t\tour_session\tbar\n")
+
+        c = MozillaCookieJar()
+        c.revert(filename)
+        self.assertEqual([cookie.name for cookie in c], ["perm"])
+
+        c = MozillaCookieJar()
+        c.revert(filename, ignore_discard=True)
+        self.assertEqual(sorted(cookie.name for cookie in c),
+                         ["curl_session", "our_session", "perm"])
+        for cookie in c:
+            if cookie.name == "perm":
+                self.assertEqual(cookie.expires, expires)
+                self.assertFalse(cookie.discard)
+            else:
+                self.assertIsNone(cookie.expires)
+                self.assertTrue(cookie.discard)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst b/Misc/NEWS.d/next/Library/2019-02-08-17-33-49.gh-issue-61366.k6W5Sp.rst
@@ -0,0 +1,3 @@
+:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written
+by curl and Wget, which use ``0`` in the expiration time field.
+Contributed by Jérémie Detrey.

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+:class:`http.cookiejar.MozillaCookieJar` now reads session cookies written
	`2`	+by curl and Wget, which use ``0`` in the expiration time field.
	`3`	`+Contributed by Jérémie Detrey.`