Ushka

API reference

ushka.http.cookies

This module provides a full-stack cookie management utility, the Cookies class.

It handles parsing raw cookie headers from incoming ASGI requests and manages changes to generate appropriate Set-Cookie headers for outgoing responses.

class Cookies(dict)

Full-Stack Cookie Manager.

This class extends dict to provide comprehensive management of HTTP cookies. It handles parsing Cookie headers from incoming requests and tracks changes to generate Set-Cookie headers for outgoing responses efficiently.

Parameters

header_valuestr or bytes

The raw Cookie header value from an incoming request. If provided, it will be parsed upon initialization. Defaults to None.

secure_defaultbool

The default Secure attribute for new cookies. Defaults to True.

httponly_defaultbool

The default HttpOnly attribute for new cookies. Defaults to True.

samesite_defaultstr

The default SameSite attribute for new cookies ('lax', 'strict', 'none'). Defaults to 'lax'.

__init__(self, header_value: str | bytes | None = None, secure_default: bool = True, httponly_default: bool = True, samesite_default: str = 'lax', taint_values: bool = False)

Initializes the Cookies manager.

Parameters

header_valuestr or bytes

The raw Cookie header value from an incoming request. If provided, it will be parsed upon initialization. Defaults to None.

secure_defaultbool

The default Secure attribute for new cookies. Defaults to True.

httponly_defaultbool

The default HttpOnly attribute for new cookies. Defaults to True.

samesite_defaultstr

The default SameSite attribute for new cookies ('lax', 'strict', 'none'). Defaults to 'lax'.

taint_valuesbool

If True, values parsed from the request header are wrapped in ushka.guard.Untrusted. Defaults to False.

set(self, key: str, value: str, max_age: Optional[int] = None, expires: Optional[int] = None, path: str | None = None, domain: Optional[str] = None, secure: bool | None = None, httponly: bool | None = None, samesite: str | None = None) -> None

Defines a cookie and schedules it to be sent with the response.

This method updates the cookie's value and attributes. Changes are

tracked internally, and Set-Cookie headers will be generated

only if modifications have occurred.

Parameters


key : str

The name of the cookie.

value : str

The value of the cookie.

max_age : int, optional

The maximum age of the cookie in seconds. If `None`, it's a session cookie.

expires : int, optional

The expiration date of the cookie as a Unix timestamp.

path : str, optional

The path for which the cookie is valid. Defaults to "/".

domain : str, optional

The domain for which the cookie is valid. Defaults to `None` (current host only).

secure : bool, optional

If `True`, the cookie will only be sent over HTTPS. Defaults to `True`.

httponly : bool, optional

If `True`, the cookie cannot be accessed via client-side scripts. Defaults to `True`.

samesite : str, optional

Controls cross-site cookie behavior ('lax', 'strict', 'none'). Defaults to 'lax'.

Returns


None

This method modifies the instance in place and does not return a value.

delete(self, key: str, path: str = '/', domain: Optional[str] = None) -> None

Forces the removal of a cookie from the client's browser.

This is achieved by setting its Max-Age to 0 and Expires to a past date.

Parameters


key : str

The name of the cookie to delete.

path : str, optional

The path of the cookie to delete. Defaults to "/".

domain : str, optional

The domain of the cookie to delete. Defaults to `None`.

Returns


None

This method modifies the instance in place and does not return a value.

get_response_headers(self) -> List[Tuple[bytes, bytes]]

Generates the list of ASGI headers (bytes).