From f54c40851b0d6c4bbdab97ba518a223adda32478 Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Tue, 19 May 2026 01:23:00 +0100 Subject: [PATCH] Drop cookies on redirect (#12550) (#12640) (cherry picked from commit d57efb05f5073071ceb2d3b35d72d9d0bc4512a2) --- CHANGES/12540.bugfix.rst | 1 + aiohttp/client.py | 1 + tests/test_client_functional.py | 16 ++++++++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 CHANGES/12540.bugfix.rst Index: aiohttp-3.13.5/aiohttp/client.py =================================================================== --- aiohttp-3.13.5.orig/aiohttp/client.py +++ aiohttp-3.13.5/aiohttp/client.py @@ -892,6 +892,7 @@ class ClientSession: if url.origin() != redirect_origin: auth = None + cookies = None headers.pop(hdrs.AUTHORIZATION, None) headers.pop(hdrs.COOKIE, None) headers.pop(hdrs.PROXY_AUTHORIZATION, None) Index: aiohttp-3.13.5/tests/test_client_functional.py =================================================================== --- aiohttp-3.13.5.orig/tests/test_client_functional.py +++ aiohttp-3.13.5/tests/test_client_functional.py @@ -3564,8 +3564,20 @@ async def test_auth_persist_on_redirect_ async with aiohttp.ClientSession( connector=connector, auth=aiohttp.BasicAuth("user", "pass") ) as client: - resp = await client.get(url_from) - assert resp.status == 200 + async with client.get( + url_from, + headers={ + "Proxy-Authorization": "Basic dXNlcjpwYXNz", + "Cookie": "a=b", + }, + ) as resp: + assert resp.status == 200 + async with client.get( + url_from, + headers={"Proxy-Authorization": "Basic dXNlcjpwYXNz"}, + cookies={"a": "b"}, + ) as resp: + assert resp.status == 200 async def test_drop_auth_on_redirect_to_other_host_with_global_auth_and_base_url(