PI15886: AN INVALID COOKIE NAME CAUSES AN ILLEGALARGUMENTEXCEPTION TO BE THROWN

8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Session manager does a set a JSESSIONID cookie,
  but it wouldn't set a cookie which would result in an
  java.lang.IllegalArgumentException.
  
  Applications accessed by Android OS are not able to access
  production application due to the following error:
  
                Caused by: java.lang.IllegalArgumentException:
  Cookie name "domain" is a reserved token
                     at
  javax.servlet.http.Cookie.<init>(Cookie.java:139)
                     at
  com.ibm.ws.webcontainer.osgi.request.IRequestImpl.getCooki
                es(IRequestImpl.java:151)
                     at
  com.ibm.ws.webcontainer.srt.SRTServletRequest.getCookies(S
                RTServletRequest.java:1622)
                     at
  javax.servlet.http.HttpServletRequestWrapper.getCookies(Ht
                tpServletRequestWrapper.java:75)
                     at
  javax.servlet.http.HttpServletRequestWrapper.getCookies(Ht
                tpServletRequestWrapper.java:75)
                     at
  org.springframework.security.web.authentication.rememberme
  .AbstractRememberMeServices.extractRememberMeCookie(Abstra
                ctRememberMeServices.java:146)
                     at
  <customer package names>
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server Version    *
  *                  8.5.5 Liberty Profile users.                *
  ****************************************************************
  * PROBLEM DESCRIPTION: An invalid cookie name causes an        *
  *                      IllegalArgumentException to be thrown.  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When the WebContainer is creating cookies with an invalid name
  (for example, containing restricted words such as "domain") an
  IllegalArgumentException such as the following is thrown:
  Caused by: java.lang.IllegalArgumentException: Cookie name
  "domain" is a reserved token
  at
  javax.servlet.http.Cookie.<init>(Cookie.java:139)
  at
  com.ibm.ws.webcontainer.osgi.request.IRequestImpl.getCookies(IRe
  questImpl.java:151)
  at
  com.ibm.ws.webcontainer.srt.SRTServletRequest.getCookies(SRTServ
  letRequest.java:1622)
  at
  javax.servlet.http.HttpServletRequestWrapper.getCookies(HttpServ
  letRequestWrapper.java:75)
  at
  javax.servlet.http.HttpServletRequestWrapper.getCookies(HttpServ
  letRequestWrapper.java:75)
  ...
  

Problem conclusion

• The WebContainer has been modified to ignore cookies with
  restricted names.
  
  The fix for this APAR is currently targeted
  for inclusion in fix pack 8.5.5.5.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

• N/A
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS LIBERTY COR

• Fixed component ID

  5725L2900

Applicable component levels

• R855 PSY

     UP