ill-formed Set-Cookie header cause KeyError

[pinterior]

when 'Set-Cookie' header is ill-formed, got KeyError on iterating cookies.
is this intended behavior or an httpx bug?

versions: (httpx was installed by pip install httpx)

$ python --version
Python 3.12.9
$ pip list
Package           Version
----------------- ---------
anyio             4.8.0
certifi           2025.1.31
h11               0.14.0
httpcore          1.0.7
httpx             0.28.1
idna              3.10
pip               24.3.1
sniffio           1.3.1
typing_extensions 4.12.2

step to reproduce:

$ python
Python 3.12.9 (main, Feb 25 2025, 05:22:35) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import httpx
>>> resp = httpx.get("http://httpbin.org/response-headers?set-cookie=foo")
>>> resp
<Response [200 OK]>
>>> resp.headers
Headers({'date': 'Tue, 04 Mar 2025 19:25:27 GMT', 'content-type': 'application/json', 'content-length': '92', 'connection': 'keep-alive', 'server': 'gunicorn/19.9.0', 'set-cookie': 'foo', 'access-control-allow-origin': '*', 'access-control-allow-credentials': 'true'})
>>> resp.cookies.items()
ItemsView(<Cookies[<Cookie foo=None for httpbin.org />]>)
>>> list(resp.cookies.items())
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<frozen _collections_abc>", line 894, in __iter__
  File "/usr/local/lib/python3.12/site-packages/httpx/_models.py", line 1216, in __getitem__
    raise KeyError(name)
KeyError: 'foo'

[PrithwishDas101]

The response is sending a malformed cookie header: "Set-Cookie: foo" has no "=" or cookie value.

RFC 6265 §4.1.1 defines a cookie pair as "cookie-name "=" cookie-value". If the intended cookie has an empty value, the server should send:

Set-Cookie: foo=

HTTPX's "Cookies" mapping raises "KeyError" here because the malformed cookie is parsed with a "None" value, and "Cookies.getitem()" raises when "get()" returns "None".

If you can't change the server and need to inspect the parsed cookies, iterate over the underlying cookie jar instead:

for cookie in resp.cookies.jar:
print(cookie.name, cookie.value)

So the primary fix is to correct the server's "Set-Cookie" header. The iteration workaround lets you inspect the cookie without going through the mapping's "items()" implementation. See "RFC 6265" (https://www.rfc-editor.org/rfc/rfc6265.html#section-4.1.1) and "HTTPX's cookie implementation" (https://github.com/encode/httpx/blob/master/httpx/_models.py).