【问题标题】:I've never seen this error before: Cookie name "ctx:1420m06d05" is a reserved token我以前从未见过此错误:Cookie name "ctx:1420m06d05" is a reserved token
【发布时间】:2014-09-06 00:23:36
【问题描述】:

我在 WildFly 8.1.0 上运行一个 Web 应用程序,显然我的应用程序运行良好。但是,查看日志文件时,我注意到一个奇怪的异常。我以前从未见过这种异常。

我使用 Apache 2.4 作为反向代理。此反向代理使用 AJP 端口完成。

javax.servlet.ServletException: Cookie 名称“ctx:1420m06d05”是保留令牌

2014-07-07 11:10:57,512 ERROR [io.undertow.request] (default task-23) UT005023: Exception handling request to /app/emp/index.jspa: javax.servlet.ServletException: Cookie name "ctx:1420m06d05" is a reserved token
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:659) [jboss-jsf-api_2.2_spec-2.2.6.jar:2.2.6]
    at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:51) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:56) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_60]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_60]
    at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_60]
Caused by: java.lang.IllegalArgumentException: Cookie name "ctx:1420m06d05" is a reserved token
    at javax.servlet.http.Cookie.<init>(Cookie.java:192) [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
    at io.undertow.servlet.spec.HttpServletRequestImpl.getCookies(HttpServletRequestImpl.java:145) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at com.sun.faces.context.RequestCookieMap.get(RequestCookieMap.java:79) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at java.util.Collections$UnmodifiableMap.get(Collections.java:1339) [rt.jar:1.7.0_60]
    at com.sun.faces.context.flash.ELFlash.getCookie(ELFlash.java:956) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.context.flash.ELFlash.doPrePhaseActions(ELFlash.java:581) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.Phase.handleBeforePhase(Phase.java:215) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:99) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:121) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:646) [jboss-jsf-api_2.2_spec-2.2.6.jar:2.2.6]
    ... 28 more

目前,用户也没有注意到错误,但我很担心。此异常与 WildFly 或我的应用程序有关吗?我应该怎么做才能纠正这个错误?

【问题讨论】:

    标签: java apache cookies reverse-proxy wildfly-8


    【解决方案1】:

    这是因为 cookie 名称中包含冒号。 cookie 名称中有一些禁止字符。我同意这个例外可能会令人困惑。

    这里是相关的rfc

    【讨论】:

    • 谢谢。还有一个问题。我没有在我的应用程序中使用任何显式 cookie。也许这些cookies是由我使用的一些lib设置的,比如primefaces、spring security、CXF......有没有办法可以覆盖这些cookies名称?或者我需要等待一些新版本的库?
    • 这是一个黑客探测。当使用带有这个特定前缀的 cookie 时,有人试图找到暴露安全漏洞的服务器。
    • 如果您(错误地)在 cookie 名称中使用逗号,也会发生这种情况,导致您的预期 cookie 值被解释为 cookie 名称(不允许使用冒号或任何其他“分隔符”)。
    猜你喜欢
    • 2021-07-27
    • 2016-03-28
    • 2022-12-07
    • 1970-01-01
    • 1970-01-01
    • 2013-04-06
    • 1970-01-01
    • 2016-09-20
    • 1970-01-01
    相关资源
    最近更新 更多