Proposed aioamazondevices cookie-domain fix for issue 1133

aioamazondevices-cookie-domain-proposed-fix.md

Proposed fix for aioamazondevices #1133

The leading dot describes cookie domain scope; it is not a valid response URL host for aiohttp.CookieJar.update_cookies. Normalize the response host and put the scope in the cookie Domain attribute. Leave ordinary host-scoped cookies unchanged.

diff --git a/src/aioamazondevices/http_wrapper.py b/src/aioamazondevices/http_wrapper.py
--- a/src/aioamazondevices/http_wrapper.py
+++ b/src/aioamazondevices/http_wrapper.py
@@
-from http.cookies import Morsel
+from http.cookies import Morsel, SimpleCookie
@@
     async def set_cookies(self, cookies: dict[str, str], domain_url: URL) -> None:
         """Set session cookies."""
+        host = domain_url.host
+        if host and host.startswith(".amazon."):
+            domain = host[1:]
+            scoped = SimpleCookie()
+            for name, value in cookies.items():
+                scoped[name] = value
+                scoped[name]["domain"] = domain
+            self._session.cookie_jar.update_cookies(
+                scoped, domain_url.with_host(domain)
+            )
+            return
         self._session.cookie_jar.update_cookies(cookies, domain_url)

A regression test against the actual wrapper method:

import pytest
from aiohttp import ClientSession
from yarl import URL

from aioamazondevices.http_wrapper import AmazonHttpWrapper


@pytest.mark.asyncio
async def test_domain_cookies_reach_amazon_subdomains():
    async with ClientSession() as session:
        wrapper = object.__new__(AmazonHttpWrapper)
        wrapper._session = session
        await wrapper.set_cookies(
            {"at-acbuk": "synthetic-value"},
            URL.build(scheme="https", host=".amazon.co.uk"),
        )

        for host in ("www.amazon.co.uk", "alexa.amazon.co.uk"):
            sent = session.cookie_jar.filter_cookies(URL(f"https://{host}/"))
            assert sent["at-acbuk"].value == "synthetic-value"

        assert "at-acbuk" not in session.cookie_jar.filter_cookies(
            URL("https://www.amazon.com/")
        )

This is a draft for upstream review; the maintainer should check whether any other leading-dot hosts need the same normalization and whether the cookie domain scope matches the original refresh response.