Security

Illegal cookie name

kkalmbach
Path Finder

I think this is similar to http://answers.splunk.com/questions/3602/can-splunk-accept-cookies-with-colon-embedded but not exactly.

It seems that when I have a domain wide cookie set, I can never get to splunk (if I use a fully qualified domain name to access splunk).

Even if the cookie names appear valid, I still get an error from splunk. Here is one example.


400 Bad Request

Illegal cookie name AtworkEnv

Traceback (most recent call last): File "/opt/splunk/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 581, in respond self.process_headers() File "/opt/splunk/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 653, in process_headers raise cherrypy.HTTPError(400, msg) HTTPError: (400, 'Illegal cookie name AtworkEnv')


The domain wide cookies are set by an ap that we have no control over (and must goto daily). Also, I must use a fully qualified domain name to access splunk (we have different domain at my work).

Has anyone found a workaround for this?

Thanks

Kevin

Tags (3)

mfeeny1
Path Finder

So, I'm gathering that the workarounds to this issue are as follows:

1) Clear cookies, and try again

or...

2) Use Firefox (which has worked for me).

Am I correct? Is there anything else I can tell my Splunk users?

thx,
mfeeny1

nicci
Engager

Just wanted to say THANK YOU for this!! I've had this illegal cookie issue for MONTHS, and so far everyone I've bothered to help me looked at me like I have two heads... Firefox WORKS!!! 🙂

splunk_zen
Builder

Any progress on handling the illegal cookies?
Cherrypy just forbid me from accessing Splunk frontend after accessing a Zabbix instance on the same server:

'Illegal cookie name cb_/zabbix/items.php_parts'

0 Karma

vbumgarn
Path Finder

Bump. This just bit me again, this time with glassfish admin cookies.

This is a problem somewhere in Cookie.py.

Anyone have a little fix? Maybe something borrowed from a newer Python? I see on the tubes that this is a problem for Google Analytics, as well, as they use cookies with colons in the name.

vbumgarner
Contributor

It looks like commenting out line 653 will stop the error from killing the request. I will make sure this is filed as a bug with CherryPy.

kkalmbach
Path Finder

This does not seem to work reliably.
The Cookie.py stops processing (and raises the error) when it hits the first error.
So if the "Cookie" header contains:
good=value; b:ad=value
Things are fine with that line commented out.
If the value of "Cookie" is:
b:ad=value; good=value
Then Cookie.py stops processing and the good=value is never read in.
I think we need to comment out the raise in Cookie.py

0 Karma

kkalmbach
Path Finder

Looking at it closer, it appears there are 2 issues:

  • The first is that splunk fails with cookie names with colons in them (like the referenced issue)

  • The second is that splunk is reporting the wrong cookie name when complaining about a cookie

Not sure what we are going to do, but it would be best if splunk could handle the illegal cookie names.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...