quarkusio/quarkus · error · IllegalArgumentException

Invalid escape character in cookie value

Error message

Invalid escape character in cookie value

What it means

When ServerCookie escapes double quotes in a cookie value (escapeDoubleQuotes), a backslash is treated as an escape character; if a backslash is the last character before the closing boundary there is no following character to keep, indicating a malformed escaped value, so IllegalArgumentException is thrown.

Source

Thrown at independent-projects/resteasy-reactive/common/runtime/src/main/java/org/jboss/resteasy/reactive/common/headers/ServerCookie.java:275

     * @param s the input string
     * @param beginIndex start index inclusive
     * @param endIndex exclusive
     * @return The (possibly) escaped string
     */
    private static String escapeDoubleQuotes(String s, int beginIndex, int endIndex) {

        if (s == null || s.length() == 0 || s.indexOf('"') == -1) {
            return s;
        }

        StringBuffer b = new StringBuffer();
        for (int i = beginIndex; i < endIndex; i++) {
            char c = s.charAt(i);
            if (c == '\\') {
                b.append(c);
                //ignore the character after an escape, just append it
                if (++i >= endIndex)
                    throw new IllegalArgumentException("Invalid escape character in cookie value");
                b.append(s.charAt(i));
            } else if (c == '"')
                b.append('\\').append('"');
            else
                b.append(c);
        }

        return b.toString();
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Strip or escape trailing backslashes in cookie values before setting them (e.g. value.replaceAll("\\\\+$", "") or double-escape them).
2. URL-encode the value so backslashes never appear raw in cookie values.
3. Fix double-escaping: ensure the value is escaped exactly once in its lifecycle (avoid escaping already-quoted values again).
4. Catch IllegalArgumentException around cookie serialization to log and reject the offending value.

Example fix

// before
NewCookie c = new NewCookie("path", "C:\\dir\\"); // trailing backslash breaks escaping
// after
String safe = raw.replaceAll("\\\\+$", ""); // drop trailing backslash
NewCookie c = new NewCookie("path", URLEncoder.encode(safe, StandardCharsets.UTF_8));

static String escapeForCookie(String v) {
    return v == null ? "" : v.replace("\\", "\\\\").replaceAll("\\\\+$", "\\\\\\\\");
}

static boolean hasBalancedEscapes(String v) {
    return v == null || !(v.length() > 0 && v.charAt(v.length() - 1) == '\\');
}

try {
    ServerCookie.maybeQuote2(0, buf, value);
} catch (IllegalArgumentException e) {
    log.warn("Cookie value has invalid escape: {}", value);
    buf.append('\"').append(URLEncoder.encode(value, StandardCharsets.UTF_8)).append('\"');
}

When it happens

Trigger: A cookie value ending with a trailing backslash that also requires quoting (e.g. value "abc\\" passed through maybeQuote2 with alreadyQuoted false but isToken false, or an already-quoted value like "\"abc\\\"" with an unpaired escape) — the escape loop advances past a backslash and hits the end index.

Common situations: Windows-style path strings stored in cookies (trailing backslash); Base64 or serialized values ending in '\\'; values that were partially escaped earlier and re-escaped on the way out.

Related errors

• control character in cookie value
• param was null
• Failed to parse cookie:
• bad input
• bad input

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/a6009b6c2b310ccd. Report an issue: GitHub.