#1638033: add support for httponly on Cookie.Morsel
Reviewer: Benjamin
diff --git a/Doc/library/cookie.rst b/Doc/library/cookie.rst
index 346da5a..b6a85f5 100644
--- a/Doc/library/cookie.rst
+++ b/Doc/library/cookie.rst
@@ -148,7 +148,7 @@
--------------
-.. class:: Morsel()
+.. class:: Morsel
Abstract a key/value pair, which has some :rfc:`2109` attributes.
@@ -162,9 +162,17 @@
* ``max-age``
* ``secure``
* ``version``
+ * ``httponly``
+
+ The attribute :attr:`httponly` specifies that the cookie is only transfered
+ in HTTP requests, and is not accessible through JavaScript. This is intended
+ to mitigate some forms of cross-site scripting.
The keys are case-insensitive.
+ .. versionadded:: 2.6
+ The :attr:`httponly` attribute was added.
+
.. attribute:: Morsel.value
diff --git a/Lib/Cookie.py b/Lib/Cookie.py
index e1eb734..b2f7427 100644
--- a/Lib/Cookie.py
+++ b/Lib/Cookie.py
@@ -408,6 +408,9 @@
# For historical reasons, these attributes are also reserved:
# expires
#
+ # This is an extension from Microsoft:
+ # httponly
+ #
# This dictionary provides a mapping from the lowercase
# variant on the left to the appropriate traditional
# formatting on the right.
@@ -417,6 +420,7 @@
"domain" : "Domain",
"max-age" : "Max-Age",
"secure" : "secure",
+ "httponly" : "httponly",
"version" : "Version",
}
@@ -499,6 +503,8 @@
RA("%s=%d" % (self._reserved[K], V))
elif K == "secure":
RA(str(self._reserved[K]))
+ elif K == "httponly":
+ RA(str(self._reserved[K]))
else:
RA("%s=%s" % (self._reserved[K], V))
diff --git a/Misc/ACKS b/Misc/ACKS
index d231ece..ac8f6ed 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -122,6 +122,7 @@
Michael Chermside
Albert Chin-A-Young
Adal Chiriliuc
+Matt Chisholm
Tom Christiansen
Vadim Chugunov
David Cinege
diff --git a/Misc/NEWS b/Misc/NEWS
index d06bfeb..85adaeb 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -56,6 +56,8 @@
Library
-------
+- Issue #1638033: Cookie.Morsel gained the httponly attribute.
+
- Issue #3535: zipfile couldn't read some zip files larger than 2GB.
- Issue #3776: Deprecate the bsddb package for removal in 3.0.