Tornado uses SimpleCookie to parse out cookies from the header. If one of the cookies here is invalid it causes all the cookies to fail.

I ran into this specifically when a cookie was set using a : in the name, but basically whenever Cookie.SimpleCookie().load() throws an exception all the cookies cannot be read because they are set to an empty dictionary.

self._cookies = Cookie.SimpleCookie()
if "Cookie" in self.headers:
    try:
        self._cookies.load(
            native_str(self.headers["Cookie"]))
    except Exception:
        self._cookies = {}

This isn't a problem if you are using Tornado to set all cookies because there are sanity checks to prevent you from setting a cookie with an invalid name, but most browsers/other cookie libraries are actually not as strict about cookies as this python library is.

This could be bad if you have a session cookie of some sort and then in javascript you set a cookie that python considers invalid such as test:cookie. From here on out all cookie reading fails silently until you delete test:cookie.

Ideally I think all cookies should work, but that would require writing a custom cookie parser. Second best I think would be if all the cookies work except for the invalid ones and there is a warning logged to notify the developer that it failed.