[pratheekrebala]

We're working on migrating away from requests-cache and we got bit by a subtle bug in how the two packages handle cookie restoration.

Unlike the previous package, the aiohttp version seems to unconditionally restore cookies when we get a cache hit. This ends up invalidating login sessions after a cache hit.

aiohttp-client-cache/aiohttp_client_cache/session.py

Lines 104 to 114 in dbb6e18

	if not from_cache:
	return set_response_defaults(new_response)
	else:
	self._restore_cookies(new_response)
	return cast(CachedResponse, new_response)
	# Restore any cached cookies to the session
	if response:
	self._restore_cookies(response)
	return response
	# If the response was missing or expired, send and cache a new request

I added a small flag to allow users to revert back to the previous behavior. The default behavior here should be unchanged.

Thank you for looking into this!

[alessio-locatelli]

Thank you. The proposed feature is justified, and its core implementation is correct.

While I was reviewing this, I also found a related pre-existing defect I am going to address in the next PR before we publish a patch release. The test suggestion below would be welcome if you handle it here, but I am okay with adding an integration test myself in a follow-up PR. Please re-request a review once ready.

---

Test coverage

The new test verifies that a mocked cache hit leaves the cookie jar empty when restore_cookies=False, including a cached redirect. That is useful, but narrow.

Before merging, I would strengthen the tests around the public API and actual HTTP behavior:

1. Real backend configuration: Construct CacheBackend(restore_cookies=False) rather than manually setting the property on a MagicMock.
2. Cookie preservation: Start with an existing sid=new, retrieve a cached response containing sid=old, and verify that sid=new remains.
3. Fresh responses: Verify that disabling restoration does not prevent a genuine HTTP response from updating the cookie jar.
4. Refresh behavior: Verify that refresh=True, including an HTTP 304 response, does not replay old cached cookies.
5. Default compatibility: Confirm explicitly that the default configuration still restores cookies.

The third test is particularly important. The flag must distinguish between replaying cookies from the cache and accepting fresh cookies from an HTTP server.

[alessio-locatelli]

SQLiteCache is the lower-level storage implementation, not the session cache backend. Its constructor also requires a filename, so the example cannot run as written. Use SQLiteBackend instead:

from aiohttp_client_cache import CachedSession, SQLiteBackend

cache = SQLiteBackend(restore_cookies=False)

async with CachedSession(cache=cache) as session:
    ...