One-tap login g_state cookie is not parseable on http.cookies SimpleCookie

Question

I'm trying to integrate Google One-Tap login on our website. For backend, I am using a tornado server that uses http library to parse the Cookie header and setting it. More info about tornado cookie handling here. Basically Google One-Tap login adds this g_state cookie to set the user status on how they interact with the One-Tap modal (source), and it's a behavior that we cannot change without altering the functionality of the plugin.

Now for some reason, when I call self.cookies inside the tornado request handler, it's returning empty even though Cookie header is set. The cookie header looks like this:

Cookie: g_state={"i_l":0}; token="abcde"

For some reason it didnt parse the cookie header properly. Dug up some code for parsing the cookies that tornado is using, and tried different ways to investigate it:

>>> from http.cookies import SimpleCookie
>>> token = 'g_state={"i_l":0};token="abcde"'
>>> dd = SimpleCookie()
>>> dd.load(token)
>>> dd
<SimpleCookie: >

# now try to rearranged the g_state to appear after token
>>> token2 = 'token="abcde";g_state={"i_l":0}'
>>> dd = SimpleCookie()
>>> dd.load(token2)
>>> dd
<SimpleCookie: token='abcde'>

# added sample token after it to check if it parses the cookies after g_state
>>> token2 = 'token="abcde";g_state={"i_l":0};other_token="hijkl"'
>>> dd = SimpleCookie()
>>> dd.load(token2)
>>> dd
<SimpleCookie: token='abcde'>

# without it
>>> token3 = 'token="abcde"'
>>> dd = SimpleCookie()
>>> dd.load(token3)
>>> dd
<SimpleCookie: token='abcde'>

So other cookies are still parsed as long as it's before the g_state cookie. Everything else after that are not parseable. Tried looking this issue up, and it seems theres an issue on http.cookies library on parsing curly bracket cookies (source).

Anyone knows how to format the client request to prevent sending the cookie for g_state or at least find a way to not affect it on parsing all other tokens on the Cookie header? Like maybe rearranging the g_state cookie to always put the end?

Answer 1

A workaround which is working for me: Javascript deleting the g_state cookie on all of the html pages.

<script>document.cookie = "g_state=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;";</script>