I'm using Pylons and having issues with response.set_cookie

Question

I am thinking one of the versions of Pylons is different but I could not find an easy way to tell what versions I was running. In the first example I am fairly certain it is 0.9.7 and up using webob to set the cookie. This environment is setting the @ symbol to \100. As you can see in the other environment doing the exact same thing sets the value properly. Any assistance would be appreciated if you need further information let me know.

Newer version of Pylons (I think) setting the value incorrectly

response.set_cookie('email', 'user@domain.com', max_age=3600)
response.headers
ResponseHeaders([('Content-Type', 'text/html; charset=utf-8'), ('Content-Length','0'),
 ('Pragma', 'no-cache'), ('Cache-Control', 'no-cache'), ('Set-Cookie',
'email="user\\100domain.com"; expires="Fri, 03-Jun-2011 21:07:07 GMT"; Max-Age=3600; Path=/')])

Test Environment working as normal/expected

response.set_cookie('email', 'user@domain.com', max_age=3600)
response.headers
HeaderDict([('Content-Type', 'text/html; charset=utf-8'), ('Content-Length', '0'),
('Pragma', 'no-cache'), ('Cache-Control', 'no-cache'), ('Set-Cookie', 
'email=user@domain.com; expires="Fri, 03-Jun-2011 21:07:35 GMT"; Max-Age=3600; Path=/')])

Answer 1

Its because of the newer version of webob.

The webob package in pylons 0.9.7 is ~0.9.8, which does not escape cookie values.

Somewhere between then and now, webob started escaping the values, which is causing your 'new' version to fail. If you dig into the webob codebase (newer version), this is happening in the serialize() method of Cookie where it ensures that the values are escaped properly. The old version was setting these values directly and was not escaping on serializing.

I have a similar setup with 0.9.7 running in virtualenv, so was able to reproduce this behavior on my system.

As far as you use methods from same version, they should also be unescaping the values in request so things should be fine.