An invalid character [32] was present in the Cookie value

2,079 views

Skip to first unread message

Mail Sender

unread,

May 24, 2020, 3:48:08 PM5/24/20

to YesCart - pure eCommerce, platform with open source

Hi all,

I've just upgraded from 3.5.0 to 3.6.3 and started to get this error when entering new CP app:

24-May-2020 21:12:31.954 SEVERE [http-nio-8080-exec-6] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [admin] in context with path [/cp] threw exception
        java.lang.IllegalArgumentException: An invalid character [32] was present in the Cookie value
                at org.apache.tomcat.util.http.Rfc6265CookieProcessor.validateCookieValue(Rfc6265CookieProcessor.java:189)
                at org.apache.tomcat.util.http.Rfc6265CookieProcessor.generateHeader(Rfc6265CookieProcessor.java:115)
                at org.apache.catalina.connector.Response.generateCookieString(Response.java:973)
                at org.apache.catalina.connector.Response.addCookie(Response.java:925)
                at org.apache.catalina.connector.ResponseFacade.addCookie(ResponseFacade.java:385)
                at javax.servlet.http.HttpServletResponseWrapper.addCookie(HttpServletResponseWrapper.java:60)

I'm using this software:

* App container: Apache Tomcat 9.0.26

* Java: "11.0.2" 2019-01-15 LTS

I've googled something, that it's related to Tomcat cookies processing: https://stackoverflow.com/a/46702343/6845013

App started successfully after I applied a suggested fix on Tomcat context.xml file.

But maybe you have a better ideas how to resolve this issue.

Full logs:

24-May-2020 21:12:23.494 SEVERE [http-nio-8080-exec-9] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [admin] in context with path [/cp] threw exception
        java.lang.NullPointerException
                at java.base/java.util.Arrays.stream(Arrays.java:5614)
                at org.yes.cart.security.impl.JWTAuthenticationFilter.attemptAuthentication(JWTAuthenticationFilter.java:101)
                at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.yes.cart.security.impl.LogoutFilter.doFilterInternal(LogoutFilter.java:58)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.yes.cart.security.impl.ChangePasswordFilter.doFilterInternal(ChangePasswordFilter.java:153)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
                at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
                at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
                at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
                at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
                at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
                at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
                at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
                at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526)
                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
                at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)
                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:834)
2020-05-24 21:12:30.001  INFO o.y.c.b.c.YcCronJob:54 - Starting job Evict frontend cache on DEV.JAM
2020-05-24 21:12:30.002  INFO o.y.c.b.c.CacheEvictionQueueProcessorImpl:100 - Performed 0 cache eviction calls
2020-05-24 21:12:30.002  INFO o.y.c.b.c.YcCronJob:60 - Finished job Evict frontend cache on DEV.JAM in 0s, next run Sun May 24 21:13:30 EEST 2020
24-May-2020 21:12:31.954 SEVERE [http-nio-8080-exec-6] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [admin] in context with path [/cp] threw exception
        java.lang.IllegalArgumentException: An invalid character [32] was present in the Cookie value
                at org.apache.tomcat.util.http.Rfc6265CookieProcessor.validateCookieValue(Rfc6265CookieProcessor.java:189)
                at org.apache.tomcat.util.http.Rfc6265CookieProcessor.generateHeader(Rfc6265CookieProcessor.java:115)
                at org.apache.catalina.connector.Response.generateCookieString(Response.java:973)
                at org.apache.catalina.connector.Response.addCookie(Response.java:925)
                at org.apache.catalina.connector.ResponseFacade.addCookie(ResponseFacade.java:385)
                at javax.servlet.http.HttpServletResponseWrapper.addCookie(HttpServletResponseWrapper.java:60)
                at org.springframework.security.web.firewall.FirewalledResponse.addCookie(FirewalledResponse.java:68)
                at javax.servlet.http.HttpServletResponseWrapper.addCookie(HttpServletResponseWrapper.java:60)
                at org.yes.cart.security.impl.JWTUtil.sendSuccessJWT(JWTUtil.java:156)
                at org.yes.cart.security.impl.JWTAuthenticationFilter.lambda$new$0(JWTAuthenticationFilter.java:68)
                at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.successfulAuthentication(AbstractAuthenticationProcessingFilter.java:326)
                at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:240)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.yes.cart.security.impl.LogoutFilter.doFilterInternal(LogoutFilter.java:58)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.yes.cart.security.impl.ChangePasswordFilter.doFilterInternal(ChangePasswordFilter.java:153)
                at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
                at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
                at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
                at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
                at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
                at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
                at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
                at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
                at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
                at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
                at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526)
                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
                at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678)
                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1589)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
                at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
                at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
                at java.base/java.lang.Thread.run(Thread.java:834)

Yes Cart

unread,

May 25, 2020, 3:40:57 AM5/25/20

to YesCart - pure eCommerce, platform with open source

Hi,

It is a known issue in 3.6.x, which manifests itself on newer Tomcat installations. Suggested fix is valid. This issue is already fixed in 3.7.x, which is due in June.

Regards,

YC Team

Reply all

Reply to author

Forward

0 new messages