{"record":{"id":"1cae8ed653bbd512","repo":"quarkusio/quarkus","slug":"failed-to-parse-cookie","errorCode":null,"errorMessage":"Failed to parse cookie: ","messagePattern":"Failed to parse cookie: ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"independent-projects/resteasy-reactive/common/runtime/src/main/java/org/jboss/resteasy/reactive/common/util/CookieParser.java","lineNumber":55,"sourceCode":"                    }\n\n                    cookieName = name;\n                    cookieValue = value;\n                } else if (name.equalsIgnoreCase(\"$Version\")) {\n                    version = Integer.parseInt(value);\n                } else if (name.equalsIgnoreCase(\"$Path\")) {\n                    path = value;\n                } else if (name.equalsIgnoreCase(\"$Domain\")) {\n                    domain = value;\n                }\n            }\n            if (cookieName != null) {\n                cookies.add(new Cookie(cookieName, cookieValue, path, domain, version));\n\n            }\n            return cookies;\n        } catch (Exception ex) {\n            throw new IllegalArgumentException(\"Failed to parse cookie: \" + cookieHeader, ex);\n        }\n    }\n}\n","sourceCodeStart":37,"sourceCodeEnd":59,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/resteasy-reactive/common/runtime/src/main/java/org/jboss/resteasy/reactive/common/util/CookieParser.java#L37-L59","documentation":"CookieParser.parseCookies wraps any exception raised while tokenizing a Cookie header into an IllegalArgumentException whose message embeds the offending raw header. The library throws this because a syntactically invalid Cookie header (bad pairing, stray semicolons, malformed $Version/$Path attributes, bad URL-encoding) cannot be turned into Cookie objects, and the failure is a caller-input problem.","triggerScenarios":"Calling parseCookies(String cookieHeader) (public API) with a malformed header, e.g. 'a=b;c' (no '=' between pairs), 'a=b; =v' (empty name), or unquoted values containing reserved characters that break the state machine.","commonSituations":"Clients sending hand-rolled Cookie headers instead of a proper client cookie jar; proxies/gateways rewriting headers; tests feeding literal invalid cookie strings; non-ASCII values not encoded per RFC 6265.","solutions":["Log/inspect the header text embedded in the exception message to find the malformed segment","Fix the client (browser/HTTP client) to send RFC 6265-compliant Cookie headers, e.g. name=value pairs separated by '; '","If tolerating bad input, catch IllegalArgumentException around parseCookies and treat the request as unauthenticated/no-cookies instead of failing","Ensure special characters in cookie values are URL-encoded when the client sets them"],"exampleFix":"// before\nCookie[] cookies = CookieParser.parseCookies(cookieHeader);\n// after\nCookie[] cookies;\ntry {\n    cookies = CookieParser.parseCookies(cookieHeader);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Ignoring malformed Cookie header\");\n    cookies = new Cookie[0];\n}","handlingStrategy":"try-catch","validationCode":"boolean looksLikeCookie = h == null || java.util.regex.Pattern.compile(\"[^=;]+=[^;]*\").matcher(h).find();","typeGuard":null,"tryCatchPattern":"try { cookies = CookieParser.parseCookies(header); } catch (IllegalArgumentException e) { log.warn(\"Malformed Cookie header: {}\", e.getMessage()); cookies = new Cookie[0]; }","preventionTips":["Use a maintained HTTP client cookie jar instead of hand-building Cookie headers","URL-encode cookie values with special characters","Unit-test your cookie strings against CookieParser before shipping","Validate header format at the proxy/edge layer"],"tags":["http","cookie","parsing","illegal-argument"],"backgroundTag":"malformed-http-header","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}