diff options
| -rw-r--r-- | Doc/library/http.cookies.rst | 10 | ||||
| -rw-r--r-- | Lib/http/cookies.py | 6 | ||||
| -rw-r--r-- | Misc/ACKS | 1 |
3 files changed, 16 insertions, 1 deletions
diff --git a/Doc/library/http.cookies.rst b/Doc/library/http.cookies.rst index 9bffa40..0b66072 100644 --- a/Doc/library/http.cookies.rst +++ b/Doc/library/http.cookies.rst @@ -109,7 +109,7 @@ Morsel Objects -------------- -.. class:: Morsel() +.. class:: Morsel Abstract a key/value pair, which has some :rfc:`2109` attributes. @@ -123,9 +123,17 @@ Morsel Objects * ``max-age`` * ``secure`` * ``version`` + * ``httponly`` + + The attribute :attr:`httponly` specifies that the cookie is only transfered + in HTTP requests, and is not accessible through JavaScript. This is intended + to mitigate some forms of cross-site scripting. The keys are case-insensitive. + .. versionadded:: 2.6 + The :attr:`httponly` attribute was added. + .. attribute:: Morsel.value diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py index 3242d83..03d1627 100644 --- a/Lib/http/cookies.py +++ b/Lib/http/cookies.py @@ -325,6 +325,9 @@ class Morsel(dict): # For historical reasons, these attributes are also reserved: # expires # + # This is an extension from Microsoft: + # httponly + # # This dictionary provides a mapping from the lowercase # variant on the left to the appropriate traditional # formatting on the right. @@ -334,6 +337,7 @@ class Morsel(dict): "domain" : "Domain", "max-age" : "Max-Age", "secure" : "secure", + "httponly" : "httponly", "version" : "Version", } @@ -413,6 +417,8 @@ class Morsel(dict): RA("%s=%d" % (self._reserved[K], V)) elif K == "secure": RA(str(self._reserved[K])) + elif K == "httponly": + RA(str(self._reserved[K])) else: RA("%s=%s" % (self._reserved[K], V)) @@ -121,6 +121,7 @@ Nicolas Chauvat Michael Chermside Albert Chin-A-Young Adal Chiriliuc +Matt Chisholm Tom Christiansen Vadim Chugunov David Cinege |