[python] Set API key cookie as key-value pair

[rgroothuijsen]

Instead of the expected format for API key cookies such as Cookie: apikey=1234, these cookies are included in an incorrect Cookie: 1234 format. This change correctly formats the API key as a key-value pair.

Fixes #23301

@cbornet @tomplus @krjakbrjak @fa0311

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Fixes API key cookie auth in generated Python clients by sending Cookie: key=value, supporting multiple cookies, and stringifying/quoting the value while preserving base64 delimiters + / = to avoid parsing errors. Matches standard cookie syntax so servers accept cookie-based API key auth (fixes #23301).

^{Written for commit 38ff9d6. Summary will update on new commits.}

[cubic-dev-ai]

5 issues found across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

5 issues found across 8 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/openapi3/client/petstore/python/petstore_api/api_client.py">

<violation number="1" location="samples/openapi3/client/petstore/python/petstore_api/api_client.py:680">
P1: Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the `Cookie` header. The change from `quote(str(auth_setting['value']), safe='')` to `str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")` loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the Cookie header. The change from quote(str(auth_setting['value']), safe='') to str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B") loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/openapi3/client/petstore/python/petstore_api/api_client.py, line 680:

<comment>Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the `Cookie` header. The change from `quote(str(auth_setting['value']), safe='')` to `str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")` loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.</comment>

<file context>
@@ -676,8 +676,8 @@ def _apply_auth_params(
-            # Account for cookie value containing spaces or being non-string value
-            cookie_value = quote(str(auth_setting['value']), safe='')
+            # Encode spaces and semicolons in cookie value, leaving other characters as-is
+            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>

Suggested change

	cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
	# Encode spaces, semicolons, and control/special characters in cookie value
	cookie_value = quote(str(auth_setting['value']), safe='')

[wing328]

thanks for the PR

please review cubic-dev-ai feedback which seems valid to me

[cubic-dev-ai]

3 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/openapi3/client/petstore/python-aiohttp/petstore_api/api_client.py">

<violation number="1" location="samples/openapi3/client/petstore/python-aiohttp/petstore_api/api_client.py:683">
P1: The switch to `urllib.parse.quote(..., safe='+/=')` broadly URL-encodes cookie API key values, which can break authentication. Cookie values in the `Cookie` header are opaque strings and should not be URL-encoded; most backends will not decode them. For example, an API key containing `:` would be sent as `%3A`, causing the server to see a different credential value than intended. The previous approach of escaping only spaces and semicolons was correct for cookie syntax without altering other characters. Consider keeping the original manual escaping or using a cookie-specific encoding that only targets delimiters like space, semicolon, and comma.</violation>
</file>

<file name="samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py">

<violation number="1" location="samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py:681">
P1: Using `urllib.parse.quote` for cookie values over-encodes characters that are legal in HTTP cookie values (such as `:`, `@`, `?`, `&`, `%`) and can break authentication. The `Cookie` header is not a URL component, and servers do not reliably percent-decode cookie values before comparing them to configured API keys. Only characters that actually interfere with cookie header parsing (such as `;` and spaces) should be escaped, rather than applying URL percent-encoding broadly.</violation>
</file>

<file name="modules/openapi-generator/src/main/resources/python/api_client.mustache">

<violation number="1" location="modules/openapi-generator/src/main/resources/python/api_client.mustache:688">
P1: The new cookie auth implementation switches from minimal escaping (spaces and semicolons only) to `urllib.parse.quote(..., safe='+/=')`, which percent-encodes many characters valid in RFC 6265 cookie values (e.g., `:`, `@`, `!`, `#`, `%`, `&`, `*`). HTTP servers typically do **not** URL-decode values from the `Cookie` header, so encoding transforms the literal token the server expects. This can break authentication for any API key or token that contains non-base64 special characters.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: The switch to urllib.parse.quote(..., safe='+/=') broadly URL-encodes cookie API key values, which can break authentication. Cookie values in the Cookie header are opaque strings and should not be URL-encoded; most backends will not decode them. For example, an API key containing : would be sent as %3A, causing the server to see a different credential value than intended. The previous approach of escaping only spaces and semicolons was correct for cookie syntax without altering other characters. Consider keeping the original manual escaping or using a cookie-specific encoding that only targets delimiters like space, semicolon, and comma.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/openapi3/client/petstore/python-aiohttp/petstore_api/api_client.py, line 683:

<comment>The switch to `urllib.parse.quote(..., safe='+/=')` broadly URL-encodes cookie API key values, which can break authentication. Cookie values in the `Cookie` header are opaque strings and should not be URL-encoded; most backends will not decode them. For example, an API key containing `:` would be sent as `%3A`, causing the server to see a different credential value than intended. The previous approach of escaping only spaces and semicolons was correct for cookie syntax without altering other characters. Consider keeping the original manual escaping or using a cookie-specific encoding that only targets delimiters like space, semicolon, and comma.</comment>

<file context>
@@ -679,8 +679,8 @@ def _apply_auth_params(
-            # Encode spaces and semicolons in cookie value, leaving other characters as-is
-            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
+            # Account for cookie value containing spaces and special characters, excluding base64 delimiters
+            cookie_value = quote(str(auth_setting['value']), safe='+/=')
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>

[cubic-dev-ai]

P1: Using urllib.parse.quote for cookie values over-encodes characters that are legal in HTTP cookie values (such as :, @, ?, &, %) and can break authentication. The Cookie header is not a URL component, and servers do not reliably percent-decode cookie values before comparing them to configured API keys. Only characters that actually interfere with cookie header parsing (such as ; and spaces) should be escaped, rather than applying URL percent-encoding broadly.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/client/echo_api/python-disallowAdditionalPropertiesIfNotPresent/openapi_client/api_client.py, line 681:

<comment>Using `urllib.parse.quote` for cookie values over-encodes characters that are legal in HTTP cookie values (such as `:`, `@`, `?`, `&`, `%`) and can break authentication. The `Cookie` header is not a URL component, and servers do not reliably percent-decode cookie values before comparing them to configured API keys. Only characters that actually interfere with cookie header parsing (such as `;` and spaces) should be escaped, rather than applying URL percent-encoding broadly.</comment>

<file context>
@@ -677,8 +677,8 @@ def _apply_auth_params(
-            # Encode spaces and semicolons in cookie value, leaving other characters as-is
-            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
+            # Account for cookie value containing spaces and special characters, excluding base64 delimiters
+            cookie_value = quote(str(auth_setting['value']), safe='+/=')
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>

[cubic-dev-ai]

P1: The new cookie auth implementation switches from minimal escaping (spaces and semicolons only) to urllib.parse.quote(..., safe='+/='), which percent-encodes many characters valid in RFC 6265 cookie values (e.g., :, @, !, #, %, &, *). HTTP servers typically do not URL-decode values from the Cookie header, so encoding transforms the literal token the server expects. This can break authentication for any API key or token that contains non-base64 special characters.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At modules/openapi-generator/src/main/resources/python/api_client.mustache, line 688:

<comment>The new cookie auth implementation switches from minimal escaping (spaces and semicolons only) to `urllib.parse.quote(..., safe='+/=')`, which percent-encodes many characters valid in RFC 6265 cookie values (e.g., `:`, `@`, `!`, `#`, `%`, `&`, `*`). HTTP servers typically do **not** URL-decode values from the `Cookie` header, so encoding transforms the literal token the server expects. This can break authentication for any API key or token that contains non-base64 special characters.</comment>

<file context>
@@ -684,8 +684,8 @@ class ApiClient:
-            # Encode spaces and semicolons in cookie value, leaving other characters as-is
-            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
+            # Account for cookie value containing spaces and special characters, excluding base64 delimiters
+            cookie_value = quote(str(auth_setting['value']), safe='+/=')
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>