Re: cookie containing umlaut

[André Warnier]

Peter Schroer wrote:
Version 8.0.3.0
Am 01.04.2015 12:30 schrieb "Mark Thomas" <ma...@apache.org>:
On 01/04/2015 10:38, Peter Schroer wrote:
Hi,

I've got a problem with Tomcat processing cookies which contain a umlaut.
Tomcat version?

Mark


Tomcat will throw a 500 internal server error if a cookie containing a
umlaut is set. This can be easily tested by writing
"document.cookie='ä=0';"
in the developer console of the browser. The tomcat log will show the
following error:

SEVERE [http-nio-8084-exec-13]
org.apache.coyote.http11.AbstractHttp11Processor.process Error processing
request
 java.lang.IllegalArgumentException: Control character in cookie value or
attribute.
      at

org.apache.tomcat.util.http.CookieSupport.isHttpSeparator(CookieSupport.java
:185)
      at
org.apache.tomcat.util.http.Cookies.processCookieHeader(Cookies.java:281)
      at
org.apache.tomcat.util.http.Cookies.processCookies(Cookies.java:176)
      at
org.apache.tomcat.util.http.Cookies.getCookieCount(Cookies.java:106)
      at

org.apache.catalina.connector.CoyoteAdapter.parseSessionCookiesId(CoyoteAdap
ter.java:1070)
      at

org.apache.catalina.connector.CoyoteAdapter.postParseRequest(CoyoteAdapter.j
ava:827)
      at

org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:511)
      at

org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Proce
ssor.java:1015)
      at

org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(Abstrac
tProtocol.java:652)
      at

org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(H
ttp11NioProtocol.java:222)
      at

org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.jav
a:1575)
      at

org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:
1533)
      at

java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:11
45)
      at

java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:6
15)
      at java.lang.Thread.run(Thread.java:722)

I'm writing some kind of proxy and don't have any influence on the
cookies
set by third party webpages. Is there any way of stopping tomcat from
throwing this error?

Greetings Peter


By curiosity, I was trying to find the relevant RFCs, to see if "ä" is a valid name for a 
cookie.  I am not sure..

Cookies are defined in RFC6265 (http://tools.ietf.org/html/rfc6265).
That document defines the cookie-name as a "token", and refers to RFC2616 for the 
definition of token.
RFC2616 (http://tools.ietf.org/html/rfc2616#section-2.2) defines a "token" as a series of 
CHAR's, which in turn are defined as

CHAR           = <any US-ASCII character (octets 0 - 127)>


So that would tend to say that "ä" is not a valid name for a cookie ?


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org