I think this is similar to http://answers.splunk.com/questions/3602/can-splunk-accept-cookies-with-colon-embedded but not exactly.
It seems that when I have a domain wide cookie set, I can never get to splunk (if I use a fully qualified domain name to access splunk).
Even if the cookie names appear valid, I still get an error from splunk. Here is one example.
400 Bad Request
Illegal cookie name AtworkEnv
Traceback (most recent call last): File "/opt/splunk/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 581, in respond self.process_headers() File "/opt/splunk/splunk/lib/python2.6/site-packages/cherrypy/_cprequest.py", line 653, in process_headers raise cherrypy.HTTPError(400, msg) HTTPError: (400, 'Illegal cookie name AtworkEnv')
The domain wide cookies are set by an ap that we have no control over (and must goto daily). Also, I must use a fully qualified domain name to access splunk (we have different domain at my work).
Has anyone found a workaround for this?
Looking at it closer, it appears there are 2 issues:
The first is that splunk fails with cookie names with colons in them (like the referenced issue)
The second is that splunk is reporting the wrong cookie name when complaining about a cookie
Not sure what we are going to do, but it would be best if splunk could handle the illegal cookie names.
This does not seem to work reliably.
The Cookie.py stops processing (and raises the error) when it hits the first error.
So if the "Cookie" header contains:
Things are fine with that line commented out.
If the value of "Cookie" is:
Then Cookie.py stops processing and the good=value is never read in.
I think we need to comment out the raise in Cookie.py
Bump. This just bit me again, this time with glassfish admin cookies.
This is a problem somewhere in Cookie.py.
Any progress on handling the illegal cookies?
Cherrypy just forbid me from accessing Splunk frontend after accessing a Zabbix instance on the same server:
'Illegal cookie name cb/zabbix/items.phpparts'
So, I'm gathering that the workarounds to this issue are as follows:
1) Clear cookies, and try again
2) Use Firefox (which has worked for me).
Am I correct? Is there anything else I can tell my Splunk users?
Just wanted to say THANK YOU for this!! I've had this illegal cookie issue for MONTHS, and so far everyone I've bothered to help me looked at me like I have two heads... Firefox WORKS!!! 🙂