Error HTTP 500, "An invalid domain [.xxxx.com] was specified for this cookie" is presented on login

Knowledge Article

Article Number

000341036

Old Article Number

000142047

Article Type

Solutions to a Product Problem

Title

Error HTTP 500, "An invalid domain [.xxxx.com] was specified for this cookie" is presented on login - Remedy AR System Mid Tier

Summary

Customer recently upgraded to Tomcat 8.5 and now the error, "An invalid domain [.domain.com] was specified for this cookie" is presented

Product

Remedy AR System Server

Component

AR System Mid Tier

Applies to

Tomcat 8.x, RSSO can get 623 errors too because of this processor

Problem

Type Exception Report
Message java.lang.IllegalArgumentException: An invalid domain [.example.com] was specified for this cookie
Description The server encountered an unexpected condition that prevented it from fulfilling the request.
Exception
java.lang.RuntimeException: java.lang.IllegalArgumentException: An invalid domain [.example.com] was specified for this cookie
        com.remedy.arsys.stubs.GoatServlet.postInternal(GoatServlet.java:165)
        com.remedy.arsys.stubs.GoatHttpServlet.doPost(GoatHttpServlet.java:62)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
        org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        com.remedy.arsys.stubs.TenancyFilter.doFilter(TenancyFilter.java:49)
        com.bmc.rsso.agent.RSSOFilter.doFilter(RSSOFilter.java:62)
Root Cause
java.lang.IllegalArgumentException: An invalid domain [.example.com] was specified for this cookie
org.apache.tomcat.util.http.Rfc6265CookieProcessor.validateDomain(Rfc6265CookieProcessor.java:203)
org.apache.tomcat.util.http.Rfc6265CookieProcessor.generateHeader(Rfc6265CookieProcessor.java:145)
        org.apache.catalina.connector.Response.generateCookieString(Response.java:1019)
        org.apache.catalina.connector.Response.addCookie(Response.java:967)
        org.apache.catalina.connector.ResponseFacade.addCookie(ResponseFacade.java:386)
        com.remedy.arsys.session.Login.generateGUID(Login.java:175)
        com.remedy.arsys.session.Login.initSessions(Login.java:456)
        com.remedy.arsys.session.Login.establishSession(Login.java:408)
        com.remedy.arsys.session.Login.establishSession(Login.java:316)
        com.remedy.arsys.stubs.GoatServlet.postInternal(GoatServlet.java:104)
        com.remedy.arsys.stubs.GoatHttpServlet.doPost(GoatHttpServlet.java:62)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
        org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        com.remedy.arsys.stubs.TenancyFilter.doFilter(TenancyFilter.java:49)
        com.bmc.rsso.agent.RSSOFilter.doFilter(RSSOFilter.java:62)
Note The full stack trace of the root cause is available in the server logs.

Cause

Tomcat 8.0.15 or later introduces a new configuration element called CookieProcessor. This processor errors out on the "period" in the domain name.

Solution

This knowledge article may contain information that does not apply to version 21.05 or later which runs in a container environment. Please refer to Article Number 000385088 for more information about troubleshooting BMC products in containers.

More information on the CookieProcessor: https://tomcat.apache.org/tomcat-8.0-doc/config/cookie-processor.html

Current solution is to switch back to the pre-Tomcat 8.0.15 behavior by using the LegacyCookieProcessor.

Edit the Tomcat/conf/context.xml
Add the statement: inside the context XML tag following XML syntax rules
<CookieProcessor className="org.apache.tomcat.util.http.LegacyCookieProcessor" />
Restart Tomcat.

Attachment(s):