Hi, we are facing problems with cookies containing umplaut (or other special characters), causing the request processing beeing stopped and returning a blank page. I know that umlaut characters are forbidden within cookies, except when they are urlencoded, but the problem arises from third-parties createing cookies with the correct domain but containing invalid characters. Due to the request processing abort, we are unable to mark such cookies as invalid and beeing dropped next time by the client.
Apr 13, 2013 9:19:41 AM org.apache.coyote.http11.AbstractHttp11Processor process SEVERE: Error processing request java.lang.IllegalArgumentException: Control character in cookie value or attribute. at org.apache.tomcat.util.http.CookieSupport.isHttpSeparator(CookieSupport.java:193) at org.apache.tomcat.util.http.Cookies.getTokenEndPosition(Cookies.java:502) at org.apache.tomcat.util.http.Cookies.processCookieHeader(Cookies.java:349) at org.apache.tomcat.util.http.Cookies.processCookies(Cookies.java:168) at org.apache.tomcat.util.http.Cookies.getCookieCount(Cookies.java:106) at org.apache.catalina.connector.CoyoteAdapter.parseSessionCookiesId(CoyoteAdapter.java:931) at org.apache.catalina.connector.CoyoteAdapter.postParseRequest(CoyoteAdapter.java:688) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:402) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1004) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603) at java.lang.Thread.run(Thread.java:722) Is there a possibility to ignore such cookies? Setting CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0=true does not help because in org.apache.tomcat.util.http.Cookies.processCookieHeader first org.apache.tomcat.util.http.CookieSupport.isHttpSeparator is called and only than ALLOW_HTTP_SEPARATORS_IN_V0 examined: // Skip whitespace and non-token characters (separators) while (pos < end && (CookieSupport.isHttpSeparator((char) bytes[pos]) && !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 || CookieSupport.isV0Separator((char) bytes[pos]) || isWhiteSpace(bytes[pos]))) {pos++; } Maybe changing the evaluation order within the while condition could solve the problem. Why is it better throwing an exception, causing the request processing beeing aborted and returning a blank page, than ignoring the invalid cookie? In my opinion this is a serious possibility to prevent site accessing by the client through third-parties. Pls help us/me out. Thanks. Laszlo --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org