[PR #13278/d5d068cb backport][3.15] parse cookie expires date as ascii-only

[patchback]

This is a backport of PR #13278 as merged into master (d5d068c).

What do these changes do?

cookie Expires values are parsed in CookieJar._parse_date with regexes whose \d classes were compiled without re.ASCII, so \d also matches unicode decimal digits (Arabic-Indic, fullwidth and the like). response header values reach the jar decoded as utf-8, so a server can send an Expires built from non-ascii digits and int() converts them just fine, giving a valid expiry identical to the plain-ascii date.

RFC 6265 5.1.1 defines cookie-date digits as ascii only, and browsers reject such a date and keep the cookie as a session cookie, so today aiohttp can be handed a longer-lived cookie than a compliant client would retain. compiling the date regexes with re.ASCII restricts them to ascii digits, in line with the spec and with how the rest of the parser already treats digits.

Are there changes in behavior for the user?

Expires values that rely on non-ascii digits now fail to parse and clear the attribute, so the cookie becomes a session cookie, the same as any other unparseable date. plain-ascii dates are unchanged.

Is it a substantial burden for the maintainers to support this?

no, it is a flag on the existing date regexes plus a regression test.

Related issue number

N/A

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes — N/A, internal parsing only
• If you provide code modification, please add yourself to CONTRIBUTORS.txt — already present
• Add a new news fragment into the CHANGES/ folder

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.27%. Comparing base (9c1c5bd) to head (4841473).
⚠️ Report is 7 commits behind head on 3.15.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             3.15   #13317   +/-   ##
=======================================
  Coverage   98.27%   98.27%           
=======================================
  Files         136      136           
  Lines       49382    49417   +35     
  Branches     2665     2666    +1     
=======================================
+ Hits        48528    48564   +36     
  Misses        674      674           
+ Partials      180      179    -1     

Flag	Coverage Δ
CI-GHA	98.27% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.05% <100.00%> (+<0.01%)	⬆️
OS-Windows	95.73% <100.00%> (-0.01%)	⬇️
OS-macOS	97.23% <100.00%> (+<0.01%)	⬆️
Py-3.10	97.38% <100.00%> (-0.01%)	⬇️
Py-3.11	97.67% <100.00%> (+<0.01%)	⬆️
Py-3.12	97.76% <100.00%> (-0.01%)	⬇️
Py-3.13	97.74% <100.00%> (+<0.01%)	⬆️
Py-3.14	97.85% <100.00%> (+<0.01%)	⬆️
Py-3.14t	96.84% <100.00%> (-0.01%)	⬇️
Py-pypy-3.11	96.66% <100.00%> (+<0.01%)	⬆️
VM-macos	97.23% <100.00%> (+<0.01%)	⬆️
VM-ubuntu	98.05% <100.00%> (+<0.01%)	⬆️
VM-windows	95.73% <100.00%> (-0.01%)	⬇️
cython-coverage	38.52% <50.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Hooray! CodSpeed harness just leveled up!

The base and head of this comparison were measured with different runner settings, so their benchmark values are not directly comparable.

What changed between base and head:

• CodSpeed runner v5 changed how benchmarks are measured (base 4.19.1 → head 5.0.1). View release notes
• Cycle estimation (off → on) changes how benchmark performance is calculated. Learn more about cycle estimation

Re-run the base with the same settings to get a valid performance comparison.

---

_{Comparing patchback/backports/3.15/d5d068cb541ab7df5ecca14515475f9d4a379c5e/pr-13278 (4841473) with 3.15 (43b4abf)¹}

Footnotes

1. No successful run was found on 3.15 (7280414) during the generation of this report, so 43b4abf was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩