gh-148849: Deprecate http.cookies.BaseCookie.js_output()

Doc/deprecations/pending-removal-in-3.19.rst

@@ -22,3 +22,13 @@ Pending removal in Python 3.19
     supported depending on the backend implementation of hash functions.
     Prefer passing the initial data as a positional argument for maximum
     backwards compatibility.
+
+* :mod:`http.cookies`:
+
+  * :meth:`http.cookies.BaseCookie.js_output` is deprecated and will be
+    removed in Python 3.19.
+
+    This method generates a JavaScript snippet to set cookies in the browser,
+    which is no longer considered a standard or recommended approach.
+    Use :meth:`~http.cookies.BaseCookie.output` instead to generate HTTP
+    headers.

Doc/library/http.cookies.rst

@@ -109,6 +109,10 @@ Cookie Objects
 
    The meaning for *attrs* is the same as in :meth:`output`.
 
+   .. deprecated:: 3.15
+      :meth:`!js_output` is deprecated and will be removed in Python 3.19.
+      Use :meth:`output` instead.
+
 
 .. method:: BaseCookie.load(rawdata)
 

Doc/whatsnew/3.15.rst

@@ -1741,6 +1741,14 @@ New deprecations
     (Contributed by Bénédikt Tran in :gh:`134978`.)
 
 
+* :mod:`http.cookies`
+
+* :meth:`http.cookies.BaseCookie.js_output` is deprecated and will be
+  removed in Python 3.19. Use
+  :meth:`~http.cookies.BaseCookie.output` instead.
+  (Contributed by kishorhange111 in :gh:`148849`.)
+
+
 * :mod:`re`:
 
   * :func:`re.match` and :meth:`re.Pattern.match` are now

Lib/http/cookies.py

@@ -132,6 +132,7 @@
 import re
 import string
 import types
+import warnings
 
 __all__ = ["CookieError", "BaseCookie", "SimpleCookie"]
 
@@ -540,6 +541,12 @@ def __repr__(self):
         return '<%s: %s>' % (self.__class__.__name__, _spacejoin(l))
 
     def js_output(self, attrs=None):
+        warnings.warn(
+            "http.cookies.BaseCookie.js_output() is deprecated and will "
+            "be removed in Python 3.19; use output() instead",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         """Return a string suitable for JavaScript."""
         result = []
         items = sorted(self.items())

Lib/test/test_http_cookies.py

@@ -176,15 +176,17 @@ def test_load(self):
         self.assertEqual(C.output(['path']),
             'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme')
         cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme; Version=1').decode('ascii')
-        self.assertEqual(C.js_output(), fr"""
+        with self.assertWarnsRegex(DeprecationWarning, r"BaseCookie\.js_output"):
+            self.assertEqual(C.js_output(), fr"""
         <script type="text/javascript">
         <!-- begin hiding
         document.cookie = atob("{cookie_encoded}");
         // end hiding -->
         </script>
         """)
         cookie_encoded = base64.b64encode(b'Customer="WILE_E_COYOTE"; Path=/acme').decode('ascii')
-        self.assertEqual(C.js_output(['path']), fr"""
+        with self.assertWarnsRegex(DeprecationWarning, r"BaseCookie\.js_output"):
+            self.assertEqual(C.js_output(['path']), fr"""
         <script type="text/javascript">
         <!-- begin hiding
         document.cookie = atob("{cookie_encoded}");
@@ -293,15 +295,17 @@ def test_quoted_meta(self):
         self.assertEqual(C.output(['path']),
                          'Set-Cookie: Customer="WILE_E_COYOTE"; Path=/acme')
         expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme; Version=1').decode('ascii')
-        self.assertEqual(C.js_output(), fr"""
+        with self.assertWarnsRegex(DeprecationWarning, r"BaseCookie\.js_output"):
+            self.assertEqual(C.js_output(), fr"""
         <script type="text/javascript">
         <!-- begin hiding
         document.cookie = atob("{expected_encoded_cookie}");
         // end hiding -->
         </script>
         """)
         expected_encoded_cookie = base64.b64encode(b'Customer=\"WILE_E_COYOTE\"; Path=/acme').decode('ascii')
-        self.assertEqual(C.js_output(['path']), fr"""
+        with self.assertWarnsRegex(DeprecationWarning, r"BaseCookie\.js_output"):
+            self.assertEqual(C.js_output(['path']), fr"""
         <script type="text/javascript">
         <!-- begin hiding
         document.cookie = atob("{expected_encoded_cookie}");
@@ -672,16 +676,18 @@ def test_control_characters_output(self):
             morsel._key = c0  # Override private variable.
             cookie = cookies.SimpleCookie()
             cookie["cookie"] = morsel
-            with self.assertRaises(cookies.CookieError):
-                cookie.js_output()
+            with self.assertWarnsRegex(DeprecationWarning, r"BaseCookie\.js_output"):
+                with self.assertRaises(cookies.CookieError):
+                    cookie.js_output()
 
             morsel = cookies.Morsel()
             morsel.set("key", "value", "coded-value")
             morsel._coded_value = c0  # Override private variable.
             cookie = cookies.SimpleCookie()
             cookie["cookie"] = morsel
-            with self.assertRaises(cookies.CookieError):
-                cookie.js_output()
+            with self.assertWarnsRegex(DeprecationWarning, r"BaseCookie\.js_output"):
+                with self.assertRaises(cookies.CookieError):
+                    cookie.js_output()
 
 
 def load_tests(loader, tests, pattern):

Misc/NEWS.d/next/Library/2026-04-25-12-04-27.gh-issue-148849.Vk6yEW.rst

@@ -0,0 +1,2 @@
+Deprecate :meth:`http.cookies.BaseCookie.js_output`, which will be
+removed in Python 3.19. Use :meth:`http.cookies.BaseCookie.output` instead.