{"record":{"id":"9f5ac19b1bf4fc46","repo":"spring-projects/spring-security","slug":"value","errorCode":null,"errorMessage":"<value>","messagePattern":"<value>","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"web/src/main/java/org/springframework/security/web/savedrequest/SavedRequestAwareWrapper.java","lineNumber":94,"sourceCode":"\t\tthis.formats[1] = new SimpleDateFormat(\"EEEEEE, dd-MMM-yy HH:mm:ss zzz\", Locale.US);\n\t\tthis.formats[2] = new SimpleDateFormat(\"EEE MMMM d HH:mm:ss yyyy\", Locale.US);\n\t\tthis.formats[0].setTimeZone(GMT_ZONE);\n\t\tthis.formats[1].setTimeZone(GMT_ZONE);\n\t\tthis.formats[2].setTimeZone(GMT_ZONE);\n\t}\n\n\t@Override\n\tpublic long getDateHeader(String name) {\n\t\tString value = getHeader(name);\n\t\tif (value == null) {\n\t\t\treturn -1L;\n\t\t}\n\t\t// Attempt to convert the date header in a variety of formats\n\t\tlong result = FastHttpDateFormat.parseDate(value, this.formats);\n\t\tif (result != -1L) {\n\t\t\treturn result;\n\t\t}\n\t\tthrow new IllegalArgumentException(value);\n\t}\n\n\t@Override\n\tpublic @Nullable String getHeader(String name) {\n\t\tList<String> values = this.savedRequest.getHeaderValues(name);\n\t\treturn values.isEmpty() ? null : values.get(0);\n\t}\n\n\t@Override\n\tpublic Enumeration<String> getHeaderNames() {\n\t\treturn new Enumerator<>(this.savedRequest.getHeaderNames());\n\t}\n\n\t@Override\n\tpublic Enumeration<String> getHeaders(String name) {\n\t\treturn new Enumerator<>(this.savedRequest.getHeaderValues(name));\n\t}\n","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/savedrequest/SavedRequestAwareWrapper.java#L76-L112","documentation":"SavedRequestAwareWrapper.getDateHeader converts date headers stored in a saved request (e.g. If-Modified-Since) using FastHttpDateFormat against several standard formats. If the saved header value cannot be parsed in any known format, it throws IllegalArgumentException with the raw value as the message. The value typically comes from a previously saved (redirected) request replayed after authentication.","triggerScenarios":"A saved request (captured before login and replayed afterward) contains a Date-type header (e.g. If-Modified-Since) whose value is not in RFC 1123/1036 or ANSI asctime format, so parseDate returns -1 and the wrapper throws.","commonSituations":"Browsers/clients sending malformed If-Modified-Since headers; proxies rewriting date headers into nonstandard formats; tests (expecteDateHeaderIsReturnedFromSavedRequest, invalidDateHeaderIsRejected) exercising saved-request date header handling; replayed bookmarks with stale headers manipulated by middleware.","solutions":["Fix or strip the offending date header before the request is saved/replayed — validate the client sends RFC-compliant date formats (e.g. EEE, dd MMM yyyy HH:mm:ss zzz).","Catch IllegalArgumentException around getDateHeader and treat it as an invalid/unset date header.","Remove or ignore date headers when reconstructing the saved request, so the wrapper falls back to the original request.","Update Spring Security if you rely on tolerant parsing — newer versions may offer more forgiving behavior; otherwise pre-parse and normalize the header yourself."],"exampleFix":"// before\nlong d = wrapper.getDateHeader(\"If-Modified-Since\");\n// after\nlong d;\ntry {\n    d = wrapper.getDateHeader(\"If-Modified-Since\");\n} catch (IllegalArgumentException e) {\n    d = -1L; // treat as absent\n}","handlingStrategy":"try-catch","validationCode":"// Validate a date header before use\nString v = wrapper.getHeader(\"If-Modified-Since\");\nlong d = (v != null) ? FastHttpDateFormat.parseDate(v, null) : -1L;\nboolean valid = d != -1L;","typeGuard":null,"tryCatchPattern":"try {\n    long date = wrapper.getDateHeader(\"If-Modified-Since\");\n    handle(date);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Unparseable date header value: {}\", e.getMessage());\n    handle(-1L);\n}","preventionTips":["Send dates in RFC 1123 format (EEE, dd MMM yyyy HH:mm:ss zzz)","Strip malformed date headers from replayed saved requests","Wrap date-header parsing in try-catch in filter code","Test saved-request replay with edge-case headers"],"tags":["spring-security","saved-request","date-parsing","illegalargumentexception"],"backgroundTag":"invalid-date-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}