The Fix
Reuses the `quote_cookie` setting from the ClientSession's cookie jar when creating a temporary CookieJar in the request method, addressing the issue where cookies were incorrectly quoted.
Based on closed aio-libs/aiohttp issue #9336 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -0,0 +1,2 @@
@@ -0,0 +1,2 @@
+Update :py:meth:`~aiohttp.ClientSession.request` to reuse the ``quote_cookie`` setting from ``ClientSession._cookie_jar`` when processing cookies parameter.
+-- by :user:`Cycloctane`.
diff --git a/aiohttp/abc.py b/aiohttp/abc.py
import aiohttp
import asyncio
async def req():
tcp_conn = aiohttp.TCPConnector(limit=10, force_close=True)
c_jar = aiohttp.CookieJar(quote_cookie=False)
sess = aiohttp.ClientSession(connector=tcp_conn, cookie_jar=c_jar)
cookies = {"name": "val="}
resp = await sess.request(url="http://localhost:8000/", method="GET", cookies=cookies)
print(resp.request_info.headers.get("Cookie")) # name="val="
await sess.close()
asyncio.run(req())
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Option A — Apply the official fix\nReuses the `quote_cookie` setting from the ClientSession's cookie jar when creating a temporary CookieJar in the request method, addressing the issue where cookies were incorrectly quoted.\nWhen NOT to use: Do not use this fix if cookie quoting behavior is required for compliance with cookie standards.\n\n
Why This Fix Works in Production
- Trigger: ```python-traceback
- Mechanism: The ClientSession's temporary CookieJar defaults to quoting cookies, ignoring the quote_cookie setting
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Shows up under Python 3.9.6 in real deployments (not just unit tests).
- The ClientSession's temporary CookieJar defaults to quoting cookies, ignoring the quote_cookie setting
- Production symptom (often without a traceback): ```python-traceback
Proof / Evidence
- GitHub issue: #9336
- Fix PR: https://github.com/aio-libs/aiohttp/pull/10093
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.80
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.63
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“Please create a complete reproducer (or better, a failing test in a PR).”
“ClientSession()._request() creates a temporary CookieJar tmp_cookie_jar to handle the cookies from the request() parameters”
“So, perhaps we should be reusing the settings from the global CookieJar. Think you could turn that into a full test?”
“> So, perhaps we should be reusing the settings from the global CookieJar. Think you could turn that into a full test? I wonder how…”
Failure Signature (Search String)
- ```python-traceback
- Probably. Could also use private attributes if it doesn't make sense to be part of the public API.
Copy-friendly signature
Failure Signature
-----------------
```python-traceback
Probably. Could also use private attributes if it doesn't make sense to be part of the public API.
Error Message
Signature-only (no traceback captured)
Error Message
-------------
```python-traceback
Probably. Could also use private attributes if it doesn't make sense to be part of the public API.
Minimal Reproduction
import aiohttp
import asyncio
async def req():
tcp_conn = aiohttp.TCPConnector(limit=10, force_close=True)
c_jar = aiohttp.CookieJar(quote_cookie=False)
sess = aiohttp.ClientSession(connector=tcp_conn, cookie_jar=c_jar)
cookies = {"name": "val="}
resp = await sess.request(url="http://localhost:8000/", method="GET", cookies=cookies)
print(resp.request_info.headers.get("Cookie")) # name="val="
await sess.close()
asyncio.run(req())
Environment
- Python: 3.9.6
What Broke
Requests sent with unquoted cookies result in incorrect cookie headers.
Why It Broke
The ClientSession's temporary CookieJar defaults to quoting cookies, ignoring the quote_cookie setting
Fix Options (Details)
Option A — Apply the official fix
Reuses the `quote_cookie` setting from the ClientSession's cookie jar when creating a temporary CookieJar in the request method, addressing the issue where cookies were incorrectly quoted.
Fix reference: https://github.com/aio-libs/aiohttp/pull/10093
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use this fix if cookie quoting behavior is required for compliance with cookie standards.
Verify Fix
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.