Make session.cookies the only cookie store and follow redirects in Python

[FlorianREGAZ]

#25: session.cookies.clear() doesn't clear cookies

The Go session kept a cookie jar of its own, keyed by session id, so a cookie removed from session.cookies (by clear() or del) was still sent. Every request now sends withoutCookieJar: true, which makes session.cookies the only place cookies are kept.

Without a jar, upstream adds every requestCookies entry to the request without checking it against the URL (cffi_dist/main.go L235-243: SetCookies only runs when a jar exists, otherwise each cookie goes through req.AddCookie). So cookies are no longer sent as requestCookies. http.cookiejar (add_cookie_header via the existing MockRequest) picks the ones for the request URL by domain, path, secure flag and expiry, and they are sent as a Cookie header.

Separate commit: extract_cookies_to_jar now extracts straight into the session jar, so when a server expires a cookie it is removed. Before, it was dropped from the per-response jar only. That removes the xfail on test_server_can_delete_a_session_cookie.

Fixes #25

#120: cookies set during redirects are lost

followRedirects is now always false. With allow_redirects=True, execute_request follows redirects itself, the way requests does:

• 301/302/303/307/308 with a Location are followed, at most 30 times, then TooManyRedirects (a TLSClientException) is raised
• a relative Location is resolved with urljoin, and the fragment carries over unless the Location has its own
• 303 turns anything but HEAD into GET, and 301/302 turn POST into GET. When the method changes, the body and its Content-Type/Content-Length/Transfer-Encoding headers are dropped. 307/308 keep the method and body
• Authorization, and a Cookie header passed in, are dropped when the redirect changes host, port or scheme (an http to https upgrade on default ports keeps them, like requests' should_strip_auth)
• each hop's Set-Cookie goes into the session jar, and the next hop gets the jar's cookies for its URL
• the final response has response.history (the earlier responses, oldest first) and response.url set to the final URL

AsyncSession merges response.cookies into the shared jar on the event loop thread. So the final response.cookies now holds the cookies of every hop, and AsyncSession keeps them without any change to how it touches shared state.

Fixes #120

Behaviour changes

• Cookies removed from session.cookies are no longer sent, and a cookie the server expires is removed from the jar.
• Cookies are sent as a Cookie header built in Python, not as requestCookies. A Cookie header passed with the request is still sent, with the jar's cookies after it, but it is not sent on to another origin during redirects.
• Cookie values are sent exactly as stored. The native library used to strip " from them.
• response.cookies on a redirected response holds the cookies of every hop. requests only puts the final response's cookies there; each response in history still has its own.
• response.history is new, and so is tls_client.exceptions.TooManyRedirects.
• The redirect rules above (method rewriting, header stripping, the limit of 30) now come from this library instead of Go's net/http.
• allow_redirects still defaults to False. requests defaults to True for everything except HEAD; it might make sense to switch the default in a future major version, but this PR leaves it alone.

Testing

• Unit tests with the fake library: a scripted redirect chain with Set-Cookie on each hop. They check the URL, method, body, headers and cookies of every hop, that followRedirects is false and withoutCookieJar true, relative/fragment resolution, the 301/302/303/307/308 method and body rules, credential stripping across origins, the 30-redirect limit, and domain/path/secure/expiry matching of sent cookies. There are also AsyncSession tests: redirect-hop cookies land in the shared jar, and cleared cookies aren't sent.
• Integration tests against the local httpbin: /cookies/set → /cookies → cookies.clear() → /cookies is empty, del of one cookie, /cookies/delete, /redirect/3, /relative-redirect/3, /absolute-redirect/3, /redirect-to, POST through /redirect-to?status_code=301|302|303|307|308, /redirect/31 raising, Authorization and cookies not following a redirect from 127.0.0.1 to localhost, and /cookies/set with allow_redirects for both Session and AsyncSession.
• A local http.server endpoint sets a cookie on every hop of a chain (httpbin can't do that), including a hop that expires one, for both Session and AsyncSession.
• uv run ruff check, uv run ruff format --check, uv run mypy and uv run pytest (422 passed, 6 xfailed) pass.

🤖 Generated with Claude Code