Krikri::PluginHelpers::CookieJar
The slice of Python's http.cookiejar that Ansible's fetch_url puts to work on every HTTP download: fetch_url ALWAYS attaches a cookie jar and an HTTPCookieProcessor (urls.py's "if not isinstance(cookies, cookiejar.CookieJar): cookies = cookiejar.CookieJar()"), so each response's Set-Cookie headers feed one jar and every later request - every redirect hop included, urllib re-runs the processor per request - carries back the cookies that match it.
Real-world impact (xilonz.trellis_nixstats, issue #868): an SSO/login redirect chain that only converges once the flow's own session/csrf cookies travel with the hops. A cookie-less client is redirected forever (each hop minting a fresh flow id, so python's same-URL loop detector never fires) and dies on the redirect budget where Ansible lands on the final 200 page.
Scope is the per-download jar semantics: cookies live and die with one download, exactly like fetch_url's fresh CookieJar() per call - no persistence between downloads.
Instance methods
The "name=value; name2=value2" Cookie header the jar contributes
for a request to uri, or nil when nothing matches. Ordering is
python's _cookie_attrs: most-specific (longest) path first, stable
for equal lengths (jar order).
Stores the Set-Cookie headers of one response. Defaults follow python's _cookie_from_cookie_tuple: a Domain attribute (lowercased, stored in leading-dot form) is dropped unless it domain-matches the request host; a missing Path becomes the request path's directory (version-0 rule: up to but not including the last '/'); Max-Age beats Expires, and a Max-Age/expiry at or before now is a delete request for the stored cookie, not a store.