The Fix
Ensures that cookies are still parsed after encountering a malformed cookie, such as Google's g_state cookie with unescaped quotes.
Based on closed aio-libs/aiohttp issue #11632 · PR/commit linked
@@ -0,0 +1 @@
@@ -0,0 +1 @@
+Fixed cookie parser to continue parsing subsequent cookies when encountering a malformed cookie that fails regex validation, such as Google's ``g_state`` cookie with unescaped quotes -- by :user:`bdraco`.
diff --git a/aiohttp/_cookie_helpers.py b/aiohttp/_cookie_helpers.py
index 7fe8f43d12b..20a278b0d5b 100644
Name: aiohttp
Version: 3.12.15
Summary: Async http client/server framework (asyncio)
Home-page: https://github.com/aio-libs/aiohttp
Author:
Author-email:
License: Apache-2.0 AND MIT
Location: /Users/alexmohr/.local/share/uv/venv/fbn.com/api/commodities/lib/python3.11/site-packages
Requires: aiohappyeyeballs, aiosignal, attrs, frozenlist, multidict, propcache, yarl
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Option A — Apply the official fix\nEnsures that cookies are still parsed after encountering a malformed cookie, such as Google's g_state cookie with unescaped quotes.\nWhen NOT to use: This fix should not be used if strict cookie parsing is required for security reasons.\n\n
Why This Fix Works in Production
- Trigger: self.assertEqual(resp.status, 200)
- Mechanism: Malformed cookies, like Google's g_state, cause aiohttp to stop parsing subsequent cookies
- If left unfixed, this can cause silent data inconsistencies that propagate (bad cache entries, incorrect downstream decisions).
Why This Breaks in Prod
- Shows up under Python 3.11.1 in real deployments (not just unit tests).
- Malformed cookies, like Google's g_state, cause aiohttp to stop parsing subsequent cookies
- Production symptom (often without a traceback): self.assertEqual(resp.status, 200)
Proof / Evidence
- GitHub issue: #11632
- Fix PR: https://github.com/aio-libs/aiohttp/pull/11724
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.70
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.62
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“I tested 3.13 after I saw https://github.com/aio-libs/aiohttp/pull/11112 however it does not fix the issue. Note that the above test is from our real world server…”
“Any chance you could make an xfail test in a PR? Maybe @bdraco wants to check this one too, following that previous PR.”
“@Dreamsorcerer https://github.com/aio-libs/aiohttp/pull/11651.”
“btw not sure why that pr is failing, it simply adds a test, doesn't seem like it needs any documentation”
Failure Signature (Search String)
- self.assertEqual(resp.status, 200)
- ```python-traceback
Copy-friendly signature
Failure Signature
-----------------
self.assertEqual(resp.status, 200)
```python-traceback
Error Message
Signature-only (no traceback captured)
Error Message
-------------
self.assertEqual(resp.status, 200)
```python-traceback
Minimal Reproduction
Name: aiohttp
Version: 3.12.15
Summary: Async http client/server framework (asyncio)
Home-page: https://github.com/aio-libs/aiohttp
Author:
Author-email:
License: Apache-2.0 AND MIT
Location: /Users/alexmohr/.local/share/uv/venv/fbn.com/api/commodities/lib/python3.11/site-packages
Requires: aiohappyeyeballs, aiosignal, attrs, frozenlist, multidict, propcache, yarl
Environment
- Python: 3.11.1
What Broke
Cookies after g_state are not returned, leading to incomplete cookie data.
Why It Broke
Malformed cookies, like Google's g_state, cause aiohttp to stop parsing subsequent cookies
Fix Options (Details)
Option A — Apply the official fix
Ensures that cookies are still parsed after encountering a malformed cookie, such as Google's g_state cookie with unescaped quotes.
Fix reference: https://github.com/aio-libs/aiohttp/pull/11724
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix should not be used if strict cookie parsing is required for security reasons.
Verify Fix
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.