[python] Set API key cookie as key-value pair

[rgroothuijsen]

Instead of the expected format for API key cookies such as Cookie: apikey=1234, these cookies are included in an incorrect Cookie: 1234 format. This change correctly formats the API key as a key-value pair.

Fixes #23301

@cbornet @tomplus @krjakbrjak @fa0311

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Fixes API key cookie auth in generated Python clients by sending Cookie: key=value, supporting multiple cookies, and stringifying the value while encoding only spaces and semicolons to avoid parsing errors. Matches standard cookie syntax so servers accept cookie-based API key auth (fixes #23301).

^{Written for commit 07e3e01. Summary will update on new commits.}

[cubic-dev-ai]

5 issues found across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

5 issues found across 8 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

2 issues found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/openapi3/client/petstore/python/petstore_api/api_client.py">

<violation number="1" location="samples/openapi3/client/petstore/python/petstore_api/api_client.py:680">
P1: Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the `Cookie` header. The change from `quote(str(auth_setting['value']), safe='')` to `str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")` loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.</violation>
</file>

<file name="samples/openapi3/client/petstore/python-httpx-sync/petstore_api/api_client.py">

<violation number="1" location="samples/openapi3/client/petstore/python-httpx-sync/petstore_api/api_client.py:683">
P1: Cookie API key encoding only replaces spaces and semicolons, leaving other invalid or dangerous characters unescaped.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the Cookie header. The change from quote(str(auth_setting['value']), safe='') to str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B") loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/openapi3/client/petstore/python/petstore_api/api_client.py, line 680:

<comment>Cookie API-key values are now under-encoded, allowing invalid/control/non-ASCII characters to be emitted raw in the `Cookie` header. The change from `quote(str(auth_setting['value']), safe='')` to `str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")` loses protection against control characters (tabs, CR, LF) and other special characters (double quotes, backslashes, commas) that are invalid or dangerous in HTTP header/cookie values.</comment>

<file context>
@@ -676,8 +676,8 @@ def _apply_auth_params(
-            # Account for cookie value containing spaces or being non-string value
-            cookie_value = quote(str(auth_setting['value']), safe='')
+            # Encode spaces and semicolons in cookie value, leaving other characters as-is
+            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>

Suggested change

	cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
	# Encode spaces, semicolons, and control/special characters in cookie value
	cookie_value = quote(str(auth_setting['value']), safe='')

[cubic-dev-ai]

P1: Cookie API key encoding only replaces spaces and semicolons, leaving other invalid or dangerous characters unescaped.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At samples/openapi3/client/petstore/python-httpx-sync/petstore_api/api_client.py, line 683:

<comment>Cookie API key encoding only replaces spaces and semicolons, leaving other invalid or dangerous characters unescaped.</comment>

<file context>
@@ -679,8 +679,8 @@ def _apply_auth_params(
-            # Account for cookie value containing spaces or being non-string value
-            cookie_value = quote(str(auth_setting['value']), safe='')
+            # Encode spaces and semicolons in cookie value, leaving other characters as-is
+            cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
             headers['Cookie'] += f"{auth_setting['key']}={cookie_value}"
         elif auth_setting['in'] == 'header':
</file context>

Suggested change

	cookie_value = str(auth_setting['value']).replace(" ", "%20").replace(";", "%3B")
	cookie_value = quote(str(auth_setting['value']), safe='')

[wing328]

thanks for the PR

please review cubic-dev-ai feedback which seems valid to me