The HTTP response header [Saved-url] with value has been removed from the response because it is invalid

Question

I see the following warning in the Tomcat logs:

WARN 1208786 --- [http-nio-8080-exec-2] o.apache.coyote.http11.Http11Processor   : The HTTP response header [Saved-url] with value [https://example.com/jobs/1234/СЃС†РµРЅР°СЂРёСЃС‚-РґР»СЏ-youtube-РєР°РЅР°Р»Сѓ] has been removed from the response because it is invalid

java.lang.IllegalArgumentException: The Unicode character [СЃ] at code point [1,089] cannot be encoded as it is outside the permitted range of 0 to 255
    at org.apache.tomcat.util.buf.MessageBytes.toBytesSimple(MessageBytes.java:286) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.tomcat.util.buf.MessageBytes.toBytes(MessageBytes.java:259) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.http11.Http11OutputBuffer.write(Http11OutputBuffer.java:389) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.http11.Http11OutputBuffer.sendHeader(Http11OutputBuffer.java:368) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.http11.Http11Processor.prepareResponse(Http11Processor.java:1051) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.AbstractProcessor.action(AbstractProcessor.java:376) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.Response.action(Response.java:210) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.Response.sendHeaders(Response.java:444) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.catalina.connector.OutputBuffer.doFlush(OutputBuffer.java:287) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.catalina.connector.OutputBuffer.close(OutputBuffer.java:246) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.catalina.connector.Response.finishResponse(Response.java:413) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:370) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:894) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1740) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-embed-core-10.1.11.jar!/:na]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-10.1.11.jar!/:na]

Should I be concerned about this? If so, how can I properly configure Spring Boot/Tomcat to address this issue?

That URL contains characters outside the ascii range is not "percent" encoded that's why is marked invalid but the main concern could be that the application is returning a custom `saved-url` response header with invalid content. Where that header comes from? Probably nothing to do with tomcat itself — LMC, Aug 26 '23 at 21:19

Ken Chan · Answer 1 · 2023-08-27T06:38:58.617

It is because Tomcat as a HTTP compliance server is trying to enforce the HTTP header rule that any characters in the HTTP header and value should be within the ASCII codes from 0 to 255. But now your application are sending out a response whose values in the Saved-url header violate this rule and hence tomcat remove it.

The client can still receive the response body and the expected status code .It just cannot find any Saved-url response header.

And briefly check with the related part of tomcat source codes and don't think there are ways to configure such checking.

The HTTP response header [Saved-url] with value has been removed from the response because it is invalid

1 Answers1