quarkusio/quarkus · error · IllegalArgumentException

Failed to parse cookie:

Error message

Failed to parse cookie: 

What it means

CookieParser.parseCookies wraps any exception raised while tokenizing a Cookie header into an IllegalArgumentException whose message embeds the offending raw header. The library throws this because a syntactically invalid Cookie header (bad pairing, stray semicolons, malformed $Version/$Path attributes, bad URL-encoding) cannot be turned into Cookie objects, and the failure is a caller-input problem.

Source

Thrown at independent-projects/resteasy-reactive/common/runtime/src/main/java/org/jboss/resteasy/reactive/common/util/CookieParser.java:55

                    }

                    cookieName = name;
                    cookieValue = value;
                } else if (name.equalsIgnoreCase("$Version")) {
                    version = Integer.parseInt(value);
                } else if (name.equalsIgnoreCase("$Path")) {
                    path = value;
                } else if (name.equalsIgnoreCase("$Domain")) {
                    domain = value;
                }
            }
            if (cookieName != null) {
                cookies.add(new Cookie(cookieName, cookieValue, path, domain, version));

            }
            return cookies;
        } catch (Exception ex) {
            throw new IllegalArgumentException("Failed to parse cookie: " + cookieHeader, ex);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Log/inspect the header text embedded in the exception message to find the malformed segment
2. Fix the client (browser/HTTP client) to send RFC 6265-compliant Cookie headers, e.g. name=value pairs separated by '; '
3. If tolerating bad input, catch IllegalArgumentException around parseCookies and treat the request as unauthenticated/no-cookies instead of failing
4. Ensure special characters in cookie values are URL-encoded when the client sets them

Example fix

// before
Cookie[] cookies = CookieParser.parseCookies(cookieHeader);
// after
Cookie[] cookies;
try {
    cookies = CookieParser.parseCookies(cookieHeader);
} catch (IllegalArgumentException e) {
    log.warn("Ignoring malformed Cookie header");
    cookies = new Cookie[0];
}

boolean looksLikeCookie = h == null || java.util.regex.Pattern.compile("[^=;]+=[^;]*").matcher(h).find();

try { cookies = CookieParser.parseCookies(header); } catch (IllegalArgumentException e) { log.warn("Malformed Cookie header: {}", e.getMessage()); cookies = new Cookie[0]; }

When it happens

Trigger: Calling parseCookies(String cookieHeader) (public API) with a malformed header, e.g. 'a=b;c' (no '=' between pairs), 'a=b; =v' (empty name), or unquoted values containing reserved characters that break the state machine.

Common situations: Clients sending hand-rolled Cookie headers instead of a proper client cookie jar; proxies/gateways rewriting headers; tests feeding literal invalid cookie strings; non-ASCII values not encoded per RFC 6265.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Unexpected end of input: ${str}
• One of type, version or separating them ':' is missing from
• Invalid command line: ${cmdLine}
• param was null
• control character in cookie value

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/1cae8ed653bbd512. Report an issue: GitHub.