We Keep Coding

how to set cookie for cloudfront url from django

In AWS docs it says, you can set cookie to their domain like this:
Set-Cookie: CloudFront-Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cDovL2QxMTExMTFhYmNkZWY4LmNsb3VkZnJvbnQubmV0L2dhbWVfZG93bmxvYWQuemlwIiwiQ29uZGl0aW9uIjp7IklwQWRkcmVzcyI6eyJBV1M6U291cmNlSXAiOiIxOTIuMC4yLjAvMjQifSwiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE0MjY1MDAwMDB9fX1dfQ__; Domain=d111111abcdef8.cloudfront.net; Path=/; Secure; HttpOnly
Set-Cookie: CloudFront-Signature=dtKhpJ3aUYxqDIwepczPiDb9NXQ_; Domain=d111111abcdef8.cloudfront.net; Path=/; Secure; HttpOnly
Set-Cookie: CloudFront-Key-Pair-Id=K2JCJMDEHXQW5F; Domain=d111111abcdef8.cloudfront.net; Path=/; Secure; HttpOnly
but my django code:
response.set_cookie(
'CloudFront-Policy',
'eyJTdGF0ZW1lbnQ...',
domain=settings.AWS_CLOUDFRONT_DOMAIN,
secure=True,
httponly=True
)
not setting the cookie to their domain. I know it is security issue, but why AWS mentions this in documentation? any help appreciated.

okay, at the end, the solution was to use cname with altername domain. :/ turned out to be the right way anyway.

Same cookie received twice, how to handle in the client?

I am trying to write a client to some web app. At one point it sends the following Set-cookie:
JSESSIONID=1BDC39CBF91C299C3330963D1EEFE399; Path=; HttpOnly; Secure, JSESSIONID=E6FFF3B159AFB9575D47662FC70DC161; Path=/; Secure; HttpOnly, XSESSIONID=b163abe6-bd6c-4381-9f68-01eeaee15a6c; Path=/; Secure; HttpOnly
It is unclear to me what is the meaning of having the same cookie name twice and what I am supposed to send back to the server?
I checked it with the following python code:
import sys
if sys.version_info.major == 2:
from Cookie import SimpleCookie
else:
from http.cookies import SimpleCookie
set_cookie = "JSESSIONID=1BDC39CBF91C299C3330963D1EEFE399; Path=; HttpOnly; Secure, JSESSIONID=E6FFF3B159AFB9575D47662FC70DC161; Path=/; Secure; HttpOnly, XSESSIONID=b163abe6-bd6c-4381-9f68-01eeaee15a6c; Path=/; Secure; HttpOnly"
cookies = SimpleCookie()
cookies.load(set_cookie)
for name in cookies.keys():
print("{} = {}".format(name, cookies[name].value))
for field in ['secure', 'httponly', 'path']:
print(" {}: {}".format(field, cookies[name][field]))
The python 2 code shows only one of the duplicate keys. The python 3 version does not recognize this at all.
$ /usr/bin/python cookie.py
XSESSIONID = b163abe6-bd6c-4381-9f68-01eeaee15a6c
secure: True
httponly: True
path: /
JSESSIONID = E6FFF3B159AFB9575D47662FC70DC161
secure: True
httponly: True
path: /
$ python3 cookie.py
So I would like to understand what is the meaning of having the same key twice and what should be sent back to the server?
It would be also nice to understand why does the Python 3 library disregard the whole string. What do I need to do to fix it?

why does urllib.urlopen(url) fail while urllib2.urlopen(url) works. What specifically about the server response is causing this?

I just want a better idea of what's going on here, I can of course "work around" the problem by using urllib2.
import urllib
import urllib2
url = "http://www.crutchfield.com/S-pqvJFyfA8KG/p_15410415/Dynamat-10415-Xtreme-Speaker-Kit.html"
# urllib2 works fine (foo.headers / foo.read() also behave)
foo = urllib2.urlopen(url)
# urllib throws errors though, what specifically is causing this?
bar = urllib.urlopen(url)
http://pae.st/AxDW/ shows this code in action with the exception/stacktrace. foo.headers and foo.read() work fine
stu#sente.cc ~ $: curl -I "http://www.crutchfield.com/S-pqvJFyfA8KG/p_15410415/Dynamat-10415-Xtreme-Speaker-Kit.html"
HTTP/1.1 302 Object Moved
Cache-Control: private
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Location: /S-FSTWJcduy5w/p_15410415/Dynamat-10415-Xtreme-Speaker-Kit.html
Server: Microsoft-IIS/7.5
Set-Cookie: SESSIONID=FSTWJcduy5w; domain=.crutchfield.com; expires=Fri, 22-Feb-2013 22:06:43 GMT; path=/
Set-Cookie: SYSTEMID=0; domain=.crutchfield.com; expires=Fri, 22-Feb-2013 22:06:43 GMT; path=/
Set-Cookie: SESSIONDATE=02/23/2012 17:07:00; domain=.crutchfield.com; expires=Fri, 22-Feb-2013 22:06:43 GMT; path=/
X-AspNet-Version: 4.0.30319
HostName: cws105
Date: Thu, 23 Feb 2012 22:06:43 GMT
Thanks.

This server is both non-deterministic and sensitive to HTTP version. urllib2 is HTTP/1.1, urllib is HTTP/1.0. You can reproduce this by running curl --http1.0 -I "http://www.crutchfield.com/S-pqvJFyfA8KG/p_15410415/Dynamat-10415-Xtreme-Speaker-Kit.html"
a few times in a row. You should see the output curl: (52) Empty reply from server occasionally; that's the error urllib is reporting. (If you re-issue the request a bunch of times with urllib, it should succeed sometimes.)

I solved the Problem. I simply using now the urrlib instead of urllib2 and anything works fine thank you all :)

Python how to get the domain of a cookie

I want to get the domain of the cookie from the HTTP response. Code is:
cookie = Cookie.SimpleCookie()
cookie.load(cookie_string)
print 'cookie = ', cookie
this shows the cookie as
cookie= Set-Cookie: Cycle=MA==|MA==|MA==; Domain=.abc.xyz.net; expires=Tue, 05-Oct-2021 04:15:18 GMT; Path=/
I want to extract the domain from the above result.
I am trying
print cookie['Domain']
print cookie['Domain'].value
print cookie['Cycle']['Domain'].value
None of these work.
Thanks

try:
cookie['Cycle']['domain'] # lowercase domain !

Using mimetools.Message in urllib2.urlopen

I'm using urllib2.urlopen():
req = urllib2.Request('http://www.google.com')
resp = urllib2.urlopen(req)
print resp.info()
print resp.info()['set-cookie']
Date: Sat, 14 May 2011 01:24:12 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: PREF=ID=5ec78624283cc050:FF=0:TM=1305336252:LM=1305336252:S=eRXgUUuzhQbRmZxk; expires=Mon, 13-May-2013 01:24:12 GMT; path=/; domain=.google.com
Set-Cookie: NID=46=GxyZVeWbT9dn0sLa9waPGSusm1hFqGf46SPqewahg0bzbYIQX0oHff0bzJ33E2yO89npEsYkqSoX0HLSqHbCxj5tCK2E931PfEJbqDMB6lTDk4ngVAiiyObWmbHgRUC9; expires=Sun, 13-Nov-2011 01:24:12 GMT; path=/; domain=.google.com; HttpOnly
Server: gws
X-XSS-Protection: 1; mod
PREF=ID=5ec78624283cc050:FF=0:TM=1305336252:LM=1305336252:S=eRXgUUuzhQbRmZxk; expires=Mon, 13-May-2013 01:24:12 GMT; path=/; domain=.google.com, NID=46=GxyZVeWbT9dn0sLa9waPGSusm1hFqGf46SPqewahg0bzbYIQX0oHff0bzJ33E2yO89npEsYkqSoX0HLSqHbCxj5tCK2E931PfEJbqDMB6lTDk4ngVAiiyObWmbHgRUC9; expires=Sun, 13-Nov-2011 01:24:12 GMT; path=/; domain=.google.com; HttpOnly
As you can see in the headers received in the response, there are TWO statements of 'set-cookie', HOWEVER in the resp.info() object I receive it has grouped both cookie statements together and separates them by a ',' (comma)
This is troublesome to separate the cookies by this delimiter since there are commas inside the cookie information i'm try to separate with this comma delimiter
Is there an easy way to call upon each cookie string individually with this mimetools.message object? (resp.info())
else-> I'll just have to parse the headers manually without this not so helpful mimetools.message/dictionary object

Try using getheaders() to get a list of the cookies:
>>> msg = resp.info()
>>> msg.getheaders('Set-Cookie')
['PREF=ID=5975a5ee255f0949:FF=0:TM=1305336283:LM=1305336283:S=1vkES6eF4Yxd-_oM; expires=Mon, 13-May-2013 01:24:43 GMT; path=/; domain=.google.com.au', 'NID=46=lQVFZg6yKUsoWT529Hqp5gA8B_CKYd2epPIbANmw_J0UzeMt2BhuMF-gtmGsRhenUTeajKz2zILXd9xWpHWT8ZGvDcmNdkzaGX-L_-sKyY1w4e2l3DKd80JzSkt2Vp-H; expires=Sun, 13-Nov-2011 01:24:43 GMT; path=/; domain=.google.com.au; HttpOnly']
In this case, you get a list of two strings.
Then you can iterate over that list and grab whichever cookie you like. str.startswith() is your friend:
>>> cookies = msg.getheaders('Set-Cookie')
>>> for cookie in cookies:
... if cookie.startswith('PREF='):
... print 'Got PREF: ', cookie
... else:
... print 'Got another: ', cookie
...
Got PREF: PREF=ID=5975a5ee255f0949:FF=0:TM=1305336283:LM=1305336283:S=1vkES6eF4Yxd-_oM; expires=Mon, 13-May-2013 01:24:43 GMT; path=/; domain=.google.com.au
Got another: NID=46=lQVFZg6yKUsoWT529Hqp5gA8B_CKYd2epPIbANmw_J0UzeMt2BhuMF-gtmGsRhenUTeajKz2zILXd9xWpHWT8ZGvDcmNdkzaGX-L_-sKyY1w4e2l3DKd80JzSkt2Vp-H; expires=Sun, 13-Nov-2011 01:24:43 GMT; path=/; domain=.google.com.au; HttpOnly
How a newbie can find the documentation in Python
% python
Python 2.7.1 (r271:86832, Jan 29 2011, 13:30:16)
[GCC 4.2.1 (Apple Inc. build 5664)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import urllib2
>>> req = urllib2.Request('http://www.google.com')
>>> resp = urllib2.urlopen(req)
>>> help(resp.info())