Accessing all cookies in the Flask test response

Question

After I make a request with the Flask test client, I want to access the cookies that the server set. If I iterate over response.headers, I see multiple Set-Cookie headers, but if I do response.headers["Set-Cookie"], I only get one value. Additionally, the headers are unparsed strings that are hard to test.

response = client.get("/")
print(response.headers['Set-Cookie'])
'mycookie=value; Expires=Thu, 27-Jun-2019 13:42:19 GMT; Max-Age=1800; Path=/'

for item in response.headers:
    print(item)

('Content-Type', 'application/javascript')
('Content-Length', '215')
('Set-Cookie', 'mycookie=value; Expires=Thu, 27-Jun-2019 13:42:19 GMT; Max-Age=1800; Path=/')
('Set-Cookie', 'mycookie2=another; Domain=.client.com; Expires=Sun, 04-Apr-2021 13:42:19 GMT; Max-Age=62208000; Path=/')
('Set-Cookie', 'mycookie3=something; Domain=.client.com; Expires=Thu, 04-Apr-2019 14:12:19 GMT; Max-Age=1800; Path=/')

Why does accessing the Set-Cookie header only give me one header? How can I access the cookies and their properties for testing?

Answer 1

The previous answer guided me to a slightly alternate version depending on what you want to do with the cookie.

I tried using client.cookie_jar, but I was testing for a few "non-standard" attributes like HttpOnly and SameSite. The cookie returned from client.cookie_jar does not return them, so I instead inspect the Set-Cookie header:

from werkzeug.http import parse_cookie

cookies = response.headers.getlist('Set-Cookie')
cookie = next(
    (cookie for cookie in cookies if expected_cookie_name in cookie),
    None
)

assert cookie is not None
cookie_attrs = parse_cookie(cookie)

assert cookie_attrs[expected_cookie_name] == expected_cookie_value
assert 'Secure' in cookie_attrs
assert 'HttpOnly' in cookie_attrs
assert cookie_attrs['SameSite'] == 'Lax'

Answer 2

response.headers is a MultiDict, which provides the getlist method to get all the values for a given key.

response.headers.getlist('Set-Cookie')

It might be more useful to examine the cookies the client has, rather than the specific raw Set-Cookie headers returned by a response. client.cookie_jar is a CookieJar instance, iterating over it yields Cookie instances. For example, to get the value of the cookie with the name "user_id":

client.post("/login")
cookie = next(
    (cookie for cookie in client.cookie_jar if cookie.name == "user_id"),
    None
)
assert cookie is not None
assert cookie.value == "4"