hx-cookies

RFC 6265 cookie parsing and storage. Zero dependencies.

Highlights

• Parse Set-Cookie headers with domain validation and public suffix rejection
• Domain/path/secure scoping per RFC 6265
• Host-only cookies (no Domain attribute) restricted to exact origin
• Default-path computation per RFC 6265 Section 5.1.4

Usage

from hx_cookies import CookieStore, parse_set_cookie

# Parse a Set-Cookie header
cookie = parse_set_cookie("session=abc; Path=/; Secure", "https://example.com/")

# Store and retrieve cookies
store = CookieStore()
store.extract_cookies("https://example.com/", [("set-cookie", "session=abc")])
header = store.get_cookie_header("https://example.com/api")  # "session=abc"

Public API

• Cookie - single cookie with domain/path/secure/expiry scoping
• CookieStore - domain/path-scoped cookie store with dict-like access
• parse_set_cookie(header, request_url) - parse Set-Cookie header into a Cookie