You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Reinwald Warapen <re...@directi.com> on 2011/02/08 19:58:14 UTC
Issue reading a cookie having a colon in the value . Is this a bug
in Tomcat 6.0.32 ?
Hey,
I am facing a very weird problem when trying to read a cookie who's
value has a colon.
The issue faced is that when a request is routed from a jsp the cookie
versions are messed up. But when the servlet is directly called the
versions are maintained as expected . Ive written a small test having an
index.jsp and a cookieservlet. When a call goes to index.jsp ,it simply
forwards the request to CookieServlet which then sets a value
(test:test:test) to a cookie. Ive explained in detail below.
*Please note* :For the request and response traces i've used fiddler and
the code is attached in this mail for reference.The following issue
happens very randomly on the browser and every single time when using
JMeter.
Please check and let me know if this is a bug with Tomcat?
*Issue Faced in Detail:*
When a call directly goes to index.jsp . You notice in the second
request the cookie is sent as version 0. Now in the application when I
try and read the value of the cookie it prints out the value as just
test and everything after the colon is truncated.
A) First Request
//Raw Request
GET http://localhost:8081/index.jsp HTTP/1.1
Connection: close
User-Agent: Java/1.6.0_22
Host: localhost:8081
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
// Raw Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=DCA96AF717EBF0D2506A959CE415FA70; Path=/
Set-Cookie: testingcolon="test:test:test"; Version=1
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Tue, 08 Feb 2011 18:15:13 GMT
Connection: close
B)Next Request
//Raw Request
GET http://localhost:8081/index.jsp HTTP/1.1
Connection: close
Cookie: $Version=0;
JSESSIONID=DCA96AF717EBF0D2506A959CE415FA70; $Path=/;
testingcolon=test:test:test
User-Agent: Java/1.6.0_22
Host: localhost:8081
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
//Raw Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: testingcolon="test:test:test"; Version=1
Content-Type: text/html;charset=UTF-8
Content-Length: 90
Date: Tue, 08 Feb 2011 18:15:13 GMT
Connection: close
Name: JSESSIONID Value: DCA96AF717EBF0D2506A959CE415FA70
Name: testingcolon Value: test
When a call directly goes to CookieServlet.Notice in the second request
the cookie is sent as version 1. Now in the application when I try and
read the value of the cookie its prints out the value as expected which
is test:test:test
A) First Request
// Raw Request
GET http://localhost:8081/servlet/CookieServlet HTTP/1.1
Connection: close
User-Agent: Java/1.6.0_22
Host: localhost:8081
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
// Raw Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: testingcolon="test:test:test"; Version=1
Content-Length: 0
Date: Tue, 08 Feb 2011 18:16:27 GMT
Connection: close
B) Next Request
// Raw Request
GET http://localhost:8081/servlet/CookieServlet HTTP/1.1
Connection: close
Cookie: $Version="1"; testingcolon="test:test:test"
User-Agent: Java/1.6.0_22
Host: localhost:8081
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
//Raw Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: testingcolon="test:test:test"; Version=1
Content-Length: 42
Date: Tue, 08 Feb 2011 18:16:27 GMT
Connection: close
Name: testingcolon Value: test:test:test
Re: Issue reading a cookie having a colon in the value . Is this
a bug in Tomcat 6.0.32 ?
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Reinwald,
On 2/9/2011 2:49 AM, Reinwald Warapen wrote:
> On 2/9/2011 1:15 AM, Mark Thomas wrote:
>> I don't see any non-spec compliant behaviour here, just a broken user
>> agent.
>
> I dont think all the user agents are broken. Cause this happened on IE
> 8, Firefox 3.6 ,Chrome 9 and JMeter . I've even attached the logs and
> test project for your reference. If you still dont think its a problem
> then thanks for the help.
The cookie and HTTP spec say that a cookie value cannot contain an
unquoted value containing a ":", and that's exactly what you've got, there.
See:
http://www.faqs.org/rfcs/rfc2965.html Sections 3.1 and 3.3.4
and
http://www.faqs.org/rfcs/rfc2616.html Section 2.2 (specifically see the
definition of "token").
> // Raw Response
> HTTP/1.1 200 OK
> Server: Apache-Coyote/1.1
> Set-Cookie: JSESSIONID=DCA96AF717EBF0D2506A959CE415FA70; Path=/
> Set-Cookie: testingcolon="test:test:test"; Version=1
Note the quoted value and version number of "1".
> B)Next Request
>
> //Raw Request
> GET http://localhost:8081/index.jsp HTTP/1.1
> Connection: close
> Cookie: $Version=0; JSESSIONID=DCA96AF717EBF0D2506A959CE415FA70; $Path=/; testingcolon=test:test:test
Note the unquoted value and the version of "0".
This looks like a broken user agent to me.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk1UEkAACgkQ9CaO5/Lv0PC56QCgsRVJjCSzh28coDIUN/byEv6t
ioIAoKRWhU+7toPNmDAAma3yuV/UFsTU
=0E6M
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Issue reading a cookie having a colon in the value . Is this
a bug in Tomcat 6.0.32 ?
Posted by Reinwald Warapen <re...@directi.com>.
On 2/9/2011 1:15 AM, Mark Thomas wrote:
> On 08/02/2011 18:58, Reinwald Warapen wrote:
>> Hey,
>> I am facing a very weird problem when trying to read a cookie who's
>> value has a colon.
>>
>> The issue faced is that when a request is routed from a jsp the cookie
>> versions are messed up. But when the servlet is directly called the
>> versions are maintained as expected . Ive written a small test having an
>> index.jsp and a cookieservlet. When a call goes to index.jsp ,it simply
>> forwards the request to CookieServlet which then sets a value
>> (test:test:test) to a cookie. Ive explained in detail below.
>>
>> *Please note* :For the request and response traces i've used fiddler and
>> the code is attached in this mail for reference.The following issue
>> happens very randomly on the browser and every single time when using
>> JMeter.
>>
>>
>> Please check and let me know if this is a bug with Tomcat?
> Sending broadly the same message three times in a single day isn't going
> to encourage anyone to help you.
If you notice the first mail to the list sent two days ago was about URL
encoding the cookie value and just confirming about the spec. Since it
had been two days ,I assumed no one could give me an insight if I had to
URL eoncode the value.This then lead me to perform the above tests which
I assume was a bug with Tomcat since it was acting differently when a
request was routed from a jsp as mentioned in the in depth explanation
> I don't see any non-spec compliant behaviour here, just a broken user agent.
I dont think all the user agents are broken .Cause this happened on IE
8, Firefox 3.6 ,Chrome 9 and JMeter . Ive had even attached the logs and
test project for your reference. If you still dont think its a probelm
then thanks for the help.
> Mark
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Issue reading a cookie having a colon in the value . Is this
a bug in Tomcat 6.0.32 ?
Posted by Mark Thomas <ma...@apache.org>.
On 08/02/2011 18:58, Reinwald Warapen wrote:
> Hey,
> I am facing a very weird problem when trying to read a cookie who's
> value has a colon.
>
> The issue faced is that when a request is routed from a jsp the cookie
> versions are messed up. But when the servlet is directly called the
> versions are maintained as expected . Ive written a small test having an
> index.jsp and a cookieservlet. When a call goes to index.jsp ,it simply
> forwards the request to CookieServlet which then sets a value
> (test:test:test) to a cookie. Ive explained in detail below.
>
> *Please note* :For the request and response traces i've used fiddler and
> the code is attached in this mail for reference.The following issue
> happens very randomly on the browser and every single time when using
> JMeter.
>
>
> Please check and let me know if this is a bug with Tomcat?
Sending broadly the same message three times in a single day isn't going
to encourage anyone to help you.
I don't see any non-spec compliant behaviour here, just a broken user agent.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org