{"record":{"id":"d10c9c6a98775518","repo":"spring-projects/spring-security","slug":"cookie-token-1-did-not-contain-a-valid-number-co","errorCode":null,"errorMessage":"Cookie token[1] did not contain a valid number (contained '\" + cookieTokens[1] + \"')","messagePattern":"Cookie token\\[1\\] did not contain a valid number \\(contained '\" \\+ cookieTokens\\[1\\] \\+ \"'\\)","errorType":"exception","errorClass":"InvalidCookieException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java","lineNumber":174,"sourceCode":"\t\tString expectedTokenSignature = makeTokenSignature(tokenExpiryTime, userDetails.getUsername(),\n\t\t\t\tuserDetails.getPassword(), actualAlgorithm);\n\t\tif (!equals(expectedTokenSignature, actualTokenSignature)) {\n\t\t\tthrow new InvalidCookieException(\"Cookie contained signature '\" + actualTokenSignature + \"' but expected '\"\n\t\t\t\t\t+ expectedTokenSignature + \"'\");\n\t\t}\n\t\treturn userDetails;\n\t}\n\n\tprivate boolean isValidCookieTokensLength(String[] cookieTokens) {\n\t\treturn cookieTokens.length == 3 || cookieTokens.length == 4;\n\t}\n\n\tprivate long getTokenExpiryTime(String[] cookieTokens) {\n\t\ttry {\n\t\t\treturn Long.valueOf(cookieTokens[1]);\n\t\t}\n\t\tcatch (NumberFormatException nfe) {\n\t\t\tthrow new InvalidCookieException(\n\t\t\t\t\t\"Cookie token[1] did not contain a valid number (contained '\" + cookieTokens[1] + \"')\");\n\t\t}\n\t}\n\n\t/**\n\t * Calculates the digital signature to be put in the cookie. Default value is\n\t * {@link #encodingAlgorithm} applied to (\"username:tokenExpiryTime:password:key\")\n\t */\n\tprotected String makeTokenSignature(long tokenExpiryTime, String username, String password) {\n\t\tString data = username + \":\" + tokenExpiryTime + \":\" + password + \":\" + getKey();\n\t\ttry {\n\t\t\tMessageDigest digest = MessageDigest.getInstance(this.encodingAlgorithm.getDigestAlgorithm());\n\t\t\treturn new String(Hex.encode(digest.digest(data.getBytes())));\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalStateException(\"No \" + this.encodingAlgorithm.name() + \" algorithm available!\");\n\t\t}\n\t}","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java#L156-L192","documentation":"The second token in the remember-me cookie must parse as a long (epoch millis expiry). getTokenExpiryTime wraps Long.valueOf(cookieTokens[1]) and converts any NumberFormatException into InvalidCookieException reporting the offending value. It means the cookie is malformed at the expiry position.","triggerScenarios":"processAutoLoginCookie calls getTokenExpiryTime with a cookie whose second colon-separated token is non-numeric — corrupted cookie, truncation, wrong delimiter, or a cookie produced by an incompatible format.","commonSituations":"Cookie mangled by proxies or browser extensions; apps sharing cookie name with different formats; manual editing or debugging of cookies; partial cookie writes.","solutions":["Clear the cookie and log in again","Ensure no two apps on the same domain use the same remember-me cookie name","Verify intermediaries are not truncating or rewriting the Cookie header","After format upgrades, clear legacy cookies"],"exampleFix":"// before (colliding cookie names on shared domain)\nhttp.rememberMe(r -> r.key(\"k\"));\n// after\nhttp.rememberMe(r -> r.key(\"k\").cookieName(\"myapp-remember-me\"));","handlingStrategy":"try-catch","validationCode":"String[] parts = cookieValue.split(\":\");\nif (parts.length < 2 || !parts[1].matches(\"\\\\d+\")) {\n    deleteRememberMeCookie(response);\n    return;\n}","typeGuard":"boolean hasNumericExpiry(String[] cookieTokens) {\n    return cookieTokens.length >= 2 && cookieTokens[1].matches(\"\\\\d+\");\n}","tryCatchPattern":"try {\n    UserDetails u = rememberMeServices.autoLogin(request, response);\n} catch (InvalidCookieException e) {\n    cookieClearingLogoutHandler.logout(request, response, null);\n    response.sendRedirect(\"/login\");\n}","preventionTips":["Clear malformed cookies instead of retrying auto-login","Isolate cookie names between apps sharing a domain","Validate header passthrough on proxies/CDNs","Regenerate cookies after any cookie-format change"],"tags":["remember-me","spring-security","cookie","format"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}