You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Dan Checkoway <dc...@gmail.com> on 2011/05/20 21:08:32 UTC

Control character in cookie value or attribute

Recently, after updating to tomcat 7.0.14 (from 6.0.29), I started seeing
these pop up in catalina.out from time to time.  I honestly have no idea if
it's related to the tomcat version or some legitimately wacked out
Set-Cookie header coming in.  I didn't see it prior to the 7.0.14 upgrade,
but that could just be a timing coincidence.  Either way I'd like to
understand the cause.  Has anybody else seen this type of exception popping
up lately?

20-May-2011 15:17:42 org.apache.catalina.connector.CoyoteAdapter service
SEVERE: An exception or error occurred in the container during the request
processing
java.lang.IllegalArgumentException: Control character in cookie value or
attribute.
       at
org.apache.tomcat.util.http.CookieSupport.isHttpSeparator(CookieSupport.java:192)
       at
org.apache.tomcat.util.http.Cookies.processCookieHeader(Cookies.java:258)
       at
org.apache.tomcat.util.http.Cookies.processCookies(Cookies.java:157)
       at
org.apache.tomcat.util.http.Cookies.getCookieCount(Cookies.java:98)
       at
org.apache.catalina.connector.CoyoteAdapter.parseSessionCookiesId(CoyoteAdapter.java:901)
       at
org.apache.catalina.connector.CoyoteAdapter.postParseRequest(CoyoteAdapter.java:664)
       at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:394)
       at
org.apache.coyote.http11.Http11NioProcessor.process(Http11NioProcessor.java:396)
       at
org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:356)
       at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1534)
       at
java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
       at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
       at java.lang.Thread.run(Thread.java:662)

I suppose I could start logging headers, but that would get out of hand
pretty quickly...considering I only see this happen about once in 100
million requests.  Anyway, figured I'd raise the flag here first...

Dan

Re: Control character in cookie value or attribute

Posted by Dan Checkoway <dc...@gmail.com>.
Hope you don't mind...I opened a ticket for this:

https://issues.apache.org/bugzilla/show_bug.cgi?id=51260

Dan

On Tue, May 24, 2011 at 5:28 PM, Caldarale, Charles R
<Ch...@unisys.com> wrote:
>> From: Christopher Schultz [mailto:chris@christopherschultz.net]
>> Subject: Re: Control character in cookie value or attribute
>
>> On 5/24/2011 5:09 PM, Dan Checkoway wrote:
>> > -        } else if (CookieSupport.isHttpToken(value) &&
>> > -                !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 ||
>> > -                CookieSupport.isV0Token(value) &&
>> > -                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0) {
>> > +        } else if (!CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
>> > +                CookieSupport.isHttpToken(value) ||
>> > +                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
>> > +                CookieSupport.isV0Token(value)) {
>
>> Ooh... looks like that expression could use some parentheses, too.
>
> Doesn't absolutely require them, but...
>
> I have a chart of C operator precedence on my wall; it's on two pages, and if I have to look at the back side of the sheet to figure it out, the expression should have parentheses.  && and || are on the back side...
>
>  - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Re: Control character in cookie value or attribute

Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chuck,

On 5/24/2011 5:28 PM, Caldarale, Charles R wrote:
>> From: Christopher Schultz [mailto:chris@christopherschultz.net] 
>> Subject: Re: Control character in cookie value or attribute
> 
>> On 5/24/2011 5:09 PM, Dan Checkoway wrote:
>>> -        } else if (CookieSupport.isHttpToken(value) &&
>>> -                !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 ||
>>> -                CookieSupport.isV0Token(value) &&
>>> -                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0) {
>>> +        } else if (!CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
>>> +                CookieSupport.isHttpToken(value) ||
>>> +                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
>>> +                CookieSupport.isV0Token(value)) {
> 
>> Ooh... looks like that expression could use some parentheses, too.
> 
> Doesn't absolutely require them, but...
> 
> I have a chart of C operator precedence on my wall; it's on two
> pages, and if I have to look at the back side of the sheet to figure
> it out, the expression should have parentheses.  && and || are on the
> back side...

Yeah, my rules for operator precedence have always been, loosely:

Do not use parent (unless necessary) for these operators:
   . -> ! ^ unary-

In expressions where the operators are unambiguous due to standard
mathematical expectations ( * and / versus + and -), parens are not
necessary.

In logical (boolean) expressions where all operators are the same (like
lots of && or lots of ||), no parens are necessary).

Everything else should use parens.

In Java, like C, && binds tighter than ||, which means that when Dan
switched the first two expression elements, he did not change the
meaning of the expression.

Dan, including parens in your patch would be a good thing :)

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk3cLYwACgkQ9CaO5/Lv0PABlQCgtqFj8HqEFB+mSHzThSLxdbqb
a4wAn1Xvwb9jDfrTIx7ECAx+t6+jK+sC
=Dqcw
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


RE: Control character in cookie value or attribute

Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Christopher Schultz [mailto:chris@christopherschultz.net] 
> Subject: Re: Control character in cookie value or attribute

> On 5/24/2011 5:09 PM, Dan Checkoway wrote:
> > -        } else if (CookieSupport.isHttpToken(value) &&
> > -                !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 ||
> > -                CookieSupport.isV0Token(value) &&
> > -                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0) {
> > +        } else if (!CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
> > +                CookieSupport.isHttpToken(value) ||
> > +                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
> > +                CookieSupport.isV0Token(value)) {

> Ooh... looks like that expression could use some parentheses, too.

Doesn't absolutely require them, but...

I have a chart of C operator precedence on my wall; it's on two pages, and if I have to look at the back side of the sheet to figure it out, the expression should have parentheses.  && and || are on the back side...

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


Re: Control character in cookie value or attribute

Posted by Dan Checkoway <dc...@gmail.com>.
I wasn't gonna say anything about that, but I did consult my "operator
precedence" reference while looking at it...  :-)  +1 on parens!

Dan

On Tue, May 24, 2011 at 5:21 PM, Christopher Schultz
<ch...@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dan,
>
> On 5/24/2011 5:09 PM, Dan Checkoway wrote:
>> -        } else if (CookieSupport.isHttpToken(value) &&
>> -                !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 ||
>> -                CookieSupport.isV0Token(value) &&
>> -                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0) {
>> +        } else if (!CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
>> +                CookieSupport.isHttpToken(value) ||
>> +                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
>> +                CookieSupport.isV0Token(value)) {
>
> Ooh... looks like that expression could use some parentheses, too.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk3cIV8ACgkQ9CaO5/Lv0PCnLgCeMu4DbPnKULW5m5Hvm1b63c6i
> XSwAn0IDD6jd5xmTKg+WhSuC4qPWULay
> =tHC+
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Re: Control character in cookie value or attribute

Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dan,

On 5/24/2011 5:09 PM, Dan Checkoway wrote:
> -        } else if (CookieSupport.isHttpToken(value) &&
> -                !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 ||
> -                CookieSupport.isV0Token(value) &&
> -                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0) {
> +        } else if (!CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
> +                CookieSupport.isHttpToken(value) ||
> +                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
> +                CookieSupport.isV0Token(value)) {

Ooh... looks like that expression could use some parentheses, too.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk3cIV8ACgkQ9CaO5/Lv0PCnLgCeMu4DbPnKULW5m5Hvm1b63c6i
XSwAn0IDD6jd5xmTKg+WhSuC4qPWULay
=tHC+
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Re: Control character in cookie value or attribute

Posted by Dan Checkoway <dc...@gmail.com>.
Ah, thanks!  I see now that setting ALLOW_HTTP_SEPARATORS_IN_V0=true
bypasses that check in a few spots.  Probably what Chuck was alluding
to in his reply...

The one spot it wouldn't bypass is line 292 in ServerCookie.java.  You
guys could switch the order of the logical checks in there, i.e.:

-        } else if (CookieSupport.isHttpToken(value) &&
-                !CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 ||
-                CookieSupport.isV0Token(value) &&
-                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0) {
+        } else if (!CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
+                CookieSupport.isHttpToken(value) ||
+                CookieSupport.ALLOW_HTTP_SEPARATORS_IN_V0 &&
+                CookieSupport.isV0Token(value)) {

...and I think that would pretty much solve the issue for me.  Or at
least allow me to process the request and figure out what nastiness is
getting passed in the Set-Cookie value (presumably unicode).

Dan

On Tue, May 24, 2011 at 4:42 PM, Mark Thomas <ma...@apache.org> wrote:
> On 24/05/2011 21:25, Dan Checkoway wrote:
>> This is super low priority, since I assume somebody is passing junk in a
>> Set-Cookie header, but I'd love to get to the bottom of it (I'm of the "no
>> request left behind" mindset), and I'm still in the dark about what Tomcat
>> doesn't like about what it's being passed.
>>
>> Can you guys shed any light on what might evoke that "Control character in
>> cookie value or attribute" error in 7.0.14?
>
> One of the huge benefits of Tomcat is that it is open source so, if you
> know where to look, you can just check the source code to see why Tomcat
> behaves the way it does. You have a stack trace so you know the file and
> line number. Take a look at line 192 (and the couple of lines above it)
> in the following file:
> http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/CookieSupport.java?view=annotate
>
> That file is from svn trunk but it hasn't changed since 7.0.14.
>
>> I still can't get my head wrapped around which ServerCookie.* property(ies)
>> to tweak to try to figure this out.
>
> Those aren't going to help you. If a control character is detected in
> the cookie header then the whole request is toast.
>
> Mark
>
>>
>> Thanks,
>> Dan
>>
>> On Fri, May 20, 2011 at 4:56 PM, Dan Checkoway <dc...@gmail.com> wrote:
>>
>>> Ah, thanks!  To be honest I'm not sure which of those properties would work
>>> around the "Control character in cookie value or attribute" exception.
>>>
>>> Maybe org.apache.tomcat.util.http. ServerCookie.FWD_SLASH_IS_SEPARATOR?  I
>>> can't tell if "Control character" means a literal non-printable character
>>> (i.e. something between 0x00 and 0x1F), or something else like a \ getting
>>> in there, like foo\nbar.
>>>
>>> Don't suppose it could be unicode in a cookie value that's causing this?
>>> Which seems more plausible to you, 0x00 or unicode?
>>>
>>> And any specific suggestions for config tweaks would be much appreciated!
>>>
>>> Dan
>>>
>>>
>>>
>>> On Fri, May 20, 2011 at 3:56 PM, Caldarale, Charles R <
>>> Chuck.Caldarale@unisys.com> wrote:
>>>>
>>>>> From: Dan Checkoway [mailto:dcheckoway@gmail.com]
>>>>> Subject: Control character in cookie value or attribute
>>>>
>>>>> I honestly have no idea if it's related to the tomcat version
>>>>> or some legitimately wacked out Set-Cookie header coming in.
>>>>
>>>> Both, actually.  Tomcat 7 is bit more picky about what it accepts for
>>> cookies.  You can control the behavior with the cookie-related properties
>>> listed here:
>>>>
>>>>
>>> http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html#Specification
>>>>
>>>>  - Chuck
>>>>
>>>>
>>>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
>>> MATERIAL and is thus for use only by the intended recipient. If you received
>>> this in error, please contact the sender and delete the e-mail and its
>>> attachments from all computers.
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>>> For additional commands, e-mail: users-help@tomcat.apache.org
>>>>
>>>
>>>
>>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Re: Control character in cookie value or attribute

Posted by Mark Thomas <ma...@apache.org>.
On 24/05/2011 21:25, Dan Checkoway wrote:
> This is super low priority, since I assume somebody is passing junk in a
> Set-Cookie header, but I'd love to get to the bottom of it (I'm of the "no
> request left behind" mindset), and I'm still in the dark about what Tomcat
> doesn't like about what it's being passed.
> 
> Can you guys shed any light on what might evoke that "Control character in
> cookie value or attribute" error in 7.0.14?

One of the huge benefits of Tomcat is that it is open source so, if you
know where to look, you can just check the source code to see why Tomcat
behaves the way it does. You have a stack trace so you know the file and
line number. Take a look at line 192 (and the couple of lines above it)
in the following file:
http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/http/CookieSupport.java?view=annotate

That file is from svn trunk but it hasn't changed since 7.0.14.

> I still can't get my head wrapped around which ServerCookie.* property(ies)
> to tweak to try to figure this out.

Those aren't going to help you. If a control character is detected in
the cookie header then the whole request is toast.

Mark

> 
> Thanks,
> Dan
> 
> On Fri, May 20, 2011 at 4:56 PM, Dan Checkoway <dc...@gmail.com> wrote:
> 
>> Ah, thanks!  To be honest I'm not sure which of those properties would work
>> around the "Control character in cookie value or attribute" exception.
>>
>> Maybe org.apache.tomcat.util.http. ServerCookie.FWD_SLASH_IS_SEPARATOR?  I
>> can't tell if "Control character" means a literal non-printable character
>> (i.e. something between 0x00 and 0x1F), or something else like a \ getting
>> in there, like foo\nbar.
>>
>> Don't suppose it could be unicode in a cookie value that's causing this?
>> Which seems more plausible to you, 0x00 or unicode?
>>
>> And any specific suggestions for config tweaks would be much appreciated!
>>
>> Dan
>>
>>
>>
>> On Fri, May 20, 2011 at 3:56 PM, Caldarale, Charles R <
>> Chuck.Caldarale@unisys.com> wrote:
>>>
>>>> From: Dan Checkoway [mailto:dcheckoway@gmail.com]
>>>> Subject: Control character in cookie value or attribute
>>>
>>>> I honestly have no idea if it's related to the tomcat version
>>>> or some legitimately wacked out Set-Cookie header coming in.
>>>
>>> Both, actually.  Tomcat 7 is bit more picky about what it accepts for
>> cookies.  You can control the behavior with the cookie-related properties
>> listed here:
>>>
>>>
>> http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html#Specification
>>>
>>>  - Chuck
>>>
>>>
>>> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
>> MATERIAL and is thus for use only by the intended recipient. If you received
>> this in error, please contact the sender and delete the e-mail and its
>> attachments from all computers.
>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: users-help@tomcat.apache.org
>>>
>>
>>
> 




---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Re: Control character in cookie value or attribute

Posted by Dan Checkoway <dc...@gmail.com>.
This is super low priority, since I assume somebody is passing junk in a
Set-Cookie header, but I'd love to get to the bottom of it (I'm of the "no
request left behind" mindset), and I'm still in the dark about what Tomcat
doesn't like about what it's being passed.

Can you guys shed any light on what might evoke that "Control character in
cookie value or attribute" error in 7.0.14?

I still can't get my head wrapped around which ServerCookie.* property(ies)
to tweak to try to figure this out.

Thanks,
Dan

On Fri, May 20, 2011 at 4:56 PM, Dan Checkoway <dc...@gmail.com> wrote:

> Ah, thanks!  To be honest I'm not sure which of those properties would work
> around the "Control character in cookie value or attribute" exception.
>
> Maybe org.apache.tomcat.util.http. ServerCookie.FWD_SLASH_IS_SEPARATOR?  I
> can't tell if "Control character" means a literal non-printable character
> (i.e. something between 0x00 and 0x1F), or something else like a \ getting
> in there, like foo\nbar.
>
> Don't suppose it could be unicode in a cookie value that's causing this?
> Which seems more plausible to you, 0x00 or unicode?
>
> And any specific suggestions for config tweaks would be much appreciated!
>
> Dan
>
>
>
> On Fri, May 20, 2011 at 3:56 PM, Caldarale, Charles R <
> Chuck.Caldarale@unisys.com> wrote:
> >
> > > From: Dan Checkoway [mailto:dcheckoway@gmail.com]
> > > Subject: Control character in cookie value or attribute
> >
> > > I honestly have no idea if it's related to the tomcat version
> > > or some legitimately wacked out Set-Cookie header coming in.
> >
> > Both, actually.  Tomcat 7 is bit more picky about what it accepts for
> cookies.  You can control the behavior with the cookie-related properties
> listed here:
> >
> >
> http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html#Specification
> >
> >  - Chuck
> >
> >
> > THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you received
> this in error, please contact the sender and delete the e-mail and its
> attachments from all computers.
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
>
>

Re: Control character in cookie value or attribute

Posted by Dan Checkoway <dc...@gmail.com>.
Ah, thanks!  To be honest I'm not sure which of those properties would work
around the "Control character in cookie value or attribute" exception.

Maybe org.apache.tomcat.util.http. ServerCookie.FWD_SLASH_IS_SEPARATOR?  I
can't tell if "Control character" means a literal non-printable character
(i.e. something between 0x00 and 0x1F), or something else like a \ getting
in there, like foo\nbar.

Don't suppose it could be unicode in a cookie value that's causing this?
Which seems more plausible to you, 0x00 or unicode?

And any specific suggestions for config tweaks would be much appreciated!

Dan


On Fri, May 20, 2011 at 3:56 PM, Caldarale, Charles R <
Chuck.Caldarale@unisys.com> wrote:
>
> > From: Dan Checkoway [mailto:dcheckoway@gmail.com]
> > Subject: Control character in cookie value or attribute
>
> > I honestly have no idea if it's related to the tomcat version
> > or some legitimately wacked out Set-Cookie header coming in.
>
> Both, actually.  Tomcat 7 is bit more picky about what it accepts for
cookies.  You can control the behavior with the cookie-related properties
listed here:
>
>
http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html#Specification
>
>  - Chuck
>
>
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you received
this in error, please contact the sender and delete the e-mail and its
attachments from all computers.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>

RE: Control character in cookie value or attribute

Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Dan Checkoway [mailto:dcheckoway@gmail.com] 
> Subject: Control character in cookie value or attribute

> I honestly have no idea if it's related to the tomcat version 
> or some legitimately wacked out Set-Cookie header coming in.

Both, actually.  Tomcat 7 is bit more picky about what it accepts for cookies.  You can control the behavior with the cookie-related properties listed here:

http://tomcat.apache.org/tomcat-7.0-doc/config/systemprops.html#Specification

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org