ill-formed Set-Cookie header cause KeyError

[pinterior]

when 'Set-Cookie' header is ill-formed, got KeyError on iterating cookies.
is this intended behavior or an httpx bug?

versions: (httpx was installed by pip install httpx)

$ python --version
Python 3.12.9
$ pip list
Package           Version
----------------- ---------
anyio             4.8.0
certifi           2025.1.31
h11               0.14.0
httpcore          1.0.7
httpx             0.28.1
idna              3.10
pip               24.3.1
sniffio           1.3.1
typing_extensions 4.12.2

step to reproduce:

$ python
Python 3.12.9 (main, Feb 25 2025, 05:22:35) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import httpx
>>> resp = httpx.get("http://httpbin.org/response-headers?set-cookie=foo")
>>> resp
<Response [200 OK]>
>>> resp.headers
Headers({'date': 'Tue, 04 Mar 2025 19:25:27 GMT', 'content-type': 'application/json', 'content-length': '92', 'connection': 'keep-alive', 'server': 'gunicorn/19.9.0', 'set-cookie': 'foo', 'access-control-allow-origin': '*', 'access-control-allow-credentials': 'true'})
>>> resp.cookies.items()
ItemsView(<Cookies[<Cookie foo=None for httpbin.org />]>)
>>> list(resp.cookies.items())
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "<frozen _collections_abc>", line 894, in __iter__
  File "/usr/local/lib/python3.12/site-packages/httpx/_models.py", line 1216, in __getitem__
    raise KeyError(name)
KeyError: 'foo'

[ketpatil77]

I can reproduce this without httpbin or network access on HTTPX 0.28.1:

import httpx

response = httpx.Response(
    200,
    headers={"set-cookie": "foo"},
    request=httpx.Request("GET", "http://example.test/"),
)
print([(c.name, c.value) for c in response.cookies.jar])
# [('foo', None)]
list(response.cookies.items())  # KeyError: 'foo'

The underlying cookie jar retains a valueless cookie as None. HTTPX's mapping lookup then treats None as a missing key in Cookies.__getitem__. The inherited items() iteration calls that lookup, explaining why iteration fails even though the jar contains the name.

That demonstrates an inconsistency between the accepted jar entry and the mapping interface; it does not establish which malformed-header policy maintainers want.

For inspection, iterate response.cookies.jar directly and inspect cookie.name, cookie.value, cookie.domain, and cookie.path. Avoid converting to a name-only dictionary if duplicate names across domains or paths matter. If you control the server and mean an empty value, send Set-Cookie: foo=: I checked that it produces ('foo', '') and does not trigger this error.

This reproduction and the empty-value control were tested on Python 3.11 / HTTPX 0.28.1.