[python] Set API key cookie as key-value pair

[rgroothuijsen]

Instead of the expected format for API key cookies such as Cookie: apikey=1234, these cookies are included in an incorrect Cookie: 1234 format. This change correctly formats the API key as a key-value pair.

Fixes #23301

@cbornet @tomplus @krjakbrjak @fa0311

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Fixes API key cookie auth in generated Python clients by sending Cookie: key="value" and supporting multiple cookies; values are stringified and wrapped in double quotes with internal quotes escaped, preserving + / = and avoiding parsing errors (fixes #23301).

^{Written for commit 64003e5. Summary will update on new commits.}

[cubic-dev-ai]

5 issues found across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

5 issues found across 8 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/openapi3/client/petstore/python/petstore_api/api_client.py">

<violation number="1" location="samples/openapi3/client/petstore/python/petstore_api/api_client.py:680">
P1: Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the `Cookie` header. The change from `quote(str(auth_setting['value']), safe='')` to `str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")` loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the Cookie header. The change from quote(str(auth_setting['value']), safe='') to str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B") loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/openapi3/client/petstore/python/petstore_api/api_client.py, line 680:

<comment>Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the `Cookie` header. The change from `quote(str(auth_setting['value']), safe='')` to `str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")` loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.</comment>

<file context>
@@ -676,8 +676,8 @@ def _apply_auth_params(
-            # Account for cookie value containing spaces or being non-string value
-            cookie_value = quote(str(auth_setting['value']), safe='')
+            # Encode spaces and semicolons in cookie value, leaving other characters as-is
+            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>

Suggested change

	cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
	# Encode spaces, semicolons, and control/special characters in cookie value
	cookie_value = quote(str(auth_setting['value']), safe='')

[wing328]

thanks for the PR

please review cubic-dev-ai feedback which seems valid to me

[cubic-dev-ai]

All reported issues were addressed across 8 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py">

<violation number="1" location="samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py:680">
P1: Cookie authentication values that contain spaces, semicolons, commas, or backslashes can produce malformed `Cookie` headers after this change. The new block replaces `urllib.parse.quote` with simple double-quote wrapping, but Cookie header parsing typically splits on `;` and `,` regardless of surrounding quotes, and raw control characters or non-ASCII bytes can cause request failures or header-injection issues. To safely handle special characters in generated cookie values, consider retaining percent-encoding (e.g. `quote(str(auth_setting['value']), safe='+/=')`) rather than relying on quoting alone.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Cookie authentication values that contain spaces, semicolons, commas, or backslashes can produce malformed Cookie headers after this change. The new block replaces urllib.parse.quote with simple double-quote wrapping, but Cookie header parsing typically splits on ; and , regardless of surrounding quotes, and raw control characters or non-ASCII bytes can cause request failures or header-injection issues. To safely handle special characters in generated cookie values, consider retaining percent-encoding (e.g. quote(str(auth_setting['value']), safe='+/=')) rather than relying on quoting alone.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py, line 680:

<comment>Cookie authentication values that contain spaces, semicolons, commas, or backslashes can produce malformed `Cookie` headers after this change. The new block replaces `urllib.parse.quote` with simple double-quote wrapping, but Cookie header parsing typically splits on `;` and `,` regardless of surrounding quotes, and raw control characters or non-ASCII bytes can cause request failures or header-injection issues. To safely handle special characters in generated cookie values, consider retaining percent-encoding (e.g. `quote(str(auth_setting['value']), safe='+/=')`) rather than relying on quoting alone.</comment>

<file context>
@@ -677,8 +677,11 @@ def _apply_auth_params(
                 headers['Cookie'] += "; "
-            # Account for cookie value containing spaces and special characters, excluding base64 delimiters
-            cookie_value = quote(str(auth_setting['value']), safe='+/=')
+            # Account for cookie value containing spaces and special characters
+            cookie_value = str(auth_setting['value'])
+            if not re.match("^\".*\"$", cookie_value):
</file context>

Suggested change

	# Account for cookie value containing spaces and special characters
	cookie_value = str(auth_setting['value'])
	if not re.match("^\".*\"$", cookie_value):
	cookie_value = cookie_value.replace("\"", "\\\"")
	cookie_value = f"\"{cookie_value}\""
	# Account for cookie value containing spaces and special characters, excluding base64 delimiters
	cookie_value = quote(str(auth_setting['value']), safe='+/=')

[wing328]

let's go with what you've so far.

i'll take a look at the feedback from cubic-ai-dev to see if these are valid