Wildfly8.1.0 deploy jsf2.2 - cookie name is a reserved token

Question

I'm trying to use wildfly 8.1.0 to deploy jsf2.2.
I'm just deploying a simple Helloworld which generated by Netbeans7.4 while I create a new JSF project, but whenever I visit http://localhost:8080/Helloworld/ ,it tells me that

java.lang.IllegalArgumentException: Cookie name "tocTree_ref-topic-group:ref-group-applications:ref-appeditText-hi" is a reserved token

Is there something I need to config before I deploy jsf in wildfly8.1.0?
Here is my complete stack trace:

11:27:17,978 INFO  [org.jboss.as.server.deployment] (MSC service thread 1-2) JBAS015876: Starting deployment of "Helloworld.war" (runtime-name: "Helloworld.war")
11:27:18,500 INFO  [javax.enterprise.resource.webcontainer.jsf.config] (MSC service thread 1-7) 正在初始化環境「/Helloworld」的 Mojarra 2.2.6-jbossorg-4 20140501-1134
11:27:19,477 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-7) JBAS017534: Registered web context: /Helloworld
11:27:19,530 INFO  [org.jboss.as.server] (DeploymentScanner-threads - 1) JBAS018559: Deployed "Helloworld.war" (runtime-name : "Helloworld.war")
11:27:38,347 FATAL [javax.enterprise.resource.webcontainer.jsf.context] (default task-1) JSF1073：在 RESTORE_VIEW 1 的處理期間截獲 java.lang.IllegalArgumentException：UIComponent-ClientId=，訊息=Cookie name "tocTree_ref-topic-group:ref-group-applications:ref-appeditText-hi" is a reserved token
11:27:38,362 FATAL [javax.enterprise.resource.webcontainer.jsf.context] (default task-1) Cookie name "tocTree_ref-topic-group:ref-group-applications:ref-appeditText-hi" is a reserved token: java.lang.IllegalArgumentException: Cookie name "tocTree_ref-topic-group:ref-group-applications:ref-appeditText-hi" is a reserved token
    at javax.servlet.http.Cookie.<init>(Cookie.java:192) [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
    at io.undertow.servlet.spec.HttpServletRequestImpl.getCookies(HttpServletRequestImpl.java:145) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at com.sun.faces.context.RequestCookieMap.get(RequestCookieMap.java:79) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at java.util.Collections$UnmodifiableMap.get(Collections.java:1339) [rt.jar:1.7.0_40]
    at com.sun.faces.context.flash.ELFlash.getCookie(ELFlash.java:956) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.context.flash.ELFlash.doPrePhaseActions(ELFlash.java:581) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.Phase.handleBeforePhase(Phase.java:215) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:99) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.RestoreViewPhase.doPhase(RestoreViewPhase.java:121) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198) [jsf-impl-2.2.6-jbossorg-4.jar:]
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:646) [jboss-jsf-api_2.2_spec-2.2.6.jar:2.2.6]
    at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]

    at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146) [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727) [undertow-core-1.0.15.Final.jar:1.0.15.Final]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [rt.jar:1.7.0_40]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [rt.jar:1.7.0_40]
    at java.lang.Thread.run(Thread.java:724) [rt.jar:1.7.0_40]

P.S.
I'm creating the jsf project with Netbeans7.4, and just copy the .war into the wildfly-8.1.0.Final\standalone\deployments ,which deploy the project successfully. The Error shows after I visit the URL.

score 1 · Accepted Answer · edited May 23 '17 at 12:31

The answer is in the Cookie javadoc. From the constructor (links mine):

The name must conform to RFC 2109. However, vendors may provide a configuration option that allows cookie names conforming to the original Netscape Cookie Specification to be accepted.

From the setValue() method which is a bit more descriptive as to allowed characters:

With Version 0 cookies, values should not contain white space, brackets, parentheses, equals signs, commas, double quotes, slashes, question marks, at signs, colons, and semicolons. Empty values may not behave the same way on all browsers.

In your particular case, colons are causing trouble. One way is indeed ignoring the RFC2109 enforcement. You should however understand that this is currently unsupported by MSIE browsers. It'll return the cookie value with quotes and treat them as session cookies. See also Why do cookie values with whitespace arrive at the client side with quotes?

Thank you @BalusC . You mentioned(in the link) we need to URL-encode if we want to support MSIE as well. However, I tried my Helloworld project with MSIE and it works, do you know why?(I didn't URL-encode it) — nosnhoj, Sep 17 '14 at 07:20

score 0 · Answer 2 · answered Sep 17 '14 at 04:02

According to this page I googled, I added a system property and it works:

org.glassfish.web.rfc2109_cookie_names_enforced=false

However,I have no idea that this is really a solution or just a workaround.

Just leave the link and the property name for those who in need in the future.

Wildfly8.1.0 deploy jsf2.2 - cookie name is a reserved token

2 Answers2