'session cookie not being sent back to server on a per-request basis

I'm trying to implement an authentication system, part of which involves passing around a session cookie to allow the server to verify the user's identity on a per-request basis; however, when registering under a test-case and attempting to access an authenticated endpoint, despite the cookie being set in the test's local cookiejar, it does not appear in the request headers to the server.

The server creates the cookie here, by only setting the expiration date.

headers={
    "set-cookie": [{
        "name": "__session",
        "value": user_obj.serialize_session(),
        "expires": cookie_expiry(user_obj.expires_at()),
    }]
}

And the test-case is very simple

session = requests.Session()

def register(username, password):
    return session.post(
        f"{HOST}/api/auth/register",
        ...
    )

def create_invoice(education, desc, budget, deadline, files):
    return session.post(
        f"{HOST}/api/invoice/create",
        ...
    )


username, password = ...
account = register(username, password)
req = create_invoice(
    ...
)
# {"status": "error", "reason": "you must be authenticated to use this endpoint"}

On the client-side, the cookie appears to be valid on the register response:

'set-cookie': '__session="..."; expires=Fri, 22-Apr-2022 02:47:46 GMT'

But, the request from the server-side appears without any Cookie header:

Host: www.example.local:8443
User-Agent: python-requests/2.27.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 112
Content-Type: application/json

I've looked everywhere in terms of playing around with the Domain and HttpOnly attributes, but nothing appears to work. Is there a certain reason why the requests session isn't putting the session cookie in the request?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source