topic Re: Illegal cookie name in Security

Illegal cookie name

kkalmbach — Thu, 21 Oct 2010 21:01:31 GMT

I think this is similar to http://answers.splunk.com/questions/3602/can-splunk-accept-cookies-with-colon-embedded but not exactly.

It seems that when I have a domain wide cookie set, I can never get to splunk (if I use a fully qualified domain name to access splunk).

Even if the cookie names appear valid, I still get an error from splunk. Here is one example.

400 Bad Request

Illegal cookie name AtworkEnv

Traceback (most recent call last): File "/opt/splunk/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 581, in respond self.process_headers() File "/opt/splunk/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 653, in process_headers raise cherrypy.HTTPError(400, msg) HTTPError: (400, 'Illegal cookie name AtworkEnv')

The domain wide cookies are set by an ap that we have no control over (and must goto daily). Also, I must use a fully qualified domain name to access splunk (we have different domain at my work).

Has anyone found a workaround for this?

Thanks

Kevin

Re: Illegal cookie name

kkalmbach — Thu, 21 Oct 2010 21:11:26 GMT

Looking at it closer, it appears there are 2 issues:

The first is that splunk fails with cookie names with colons in them (like the referenced issue)
The second is that splunk is reporting the wrong cookie name when complaining about a cookie

Not sure what we are going to do, but it would be best if splunk could handle the illegal cookie names.

Re: Illegal cookie name

vbumgarner — Mon, 28 Mar 2011 22:55:04 GMT

It looks like commenting out line 653 will stop the error from killing the request. I will make sure this is filed as a bug with CherryPy.

Re: Illegal cookie name

kkalmbach — Tue, 05 Apr 2011 02:47:41 GMT

This does not seem to work reliably.
The Cookie.py stops processing (and raises the error) when it hits the first error.
So if the "Cookie" header contains:
good=value; b:ad=value
Things are fine with that line commented out.
If the value of "Cookie" is:
b:ad=value; good=value
Then Cookie.py stops processing and the good=value is never read in.
I think we need to comment out the raise in Cookie.py

Re: Illegal cookie name

vbumgarn — Thu, 01 Dec 2011 16:47:33 GMT

Bump. This just bit me again, this time with glassfish admin cookies.

This is a problem somewhere in Cookie.py.

Anyone have a little fix? Maybe something borrowed from a newer Python? I see on the tubes that this is a problem for Google Analytics, as well, as they use cookies with colons in the name.

Re: Illegal cookie name

splunk_zen — Mon, 28 Sep 2020 11:56:56 GMT

Any progress on handling the illegal cookies?
Cherrypy just forbid me from accessing Splunk frontend after accessing a Zabbix instance on the same server:

'Illegal cookie name cb_/zabbix/items.php_parts'

Re: Illegal cookie name

mfeeny1 — Mon, 09 Jul 2012 20:23:56 GMT

So, I'm gathering that the workarounds to this issue are as follows:

1) Clear cookies, and try again

or...

2) Use Firefox (which has worked for me).

Am I correct? Is there anything else I can tell my Splunk users?

thx,
mfeeny1

Re: Illegal cookie name

nicci — Thu, 19 Jun 2014 14:31:26 GMT

Just wanted to say THANK YOU for this!! I've had this illegal cookie issue for MONTHS, and so far everyone I've bothered to help me looked at me like I have two heads... Firefox WORKS!!! 🙂