Warning "Invalid cookie header: ... Invalid 'expires' attribute"

Describe the bug

In my application using the AWS SDK to access an S3 bucket I get in my logs several WARN messages coming from the SDK managed ApacheHttClient.

Example:

2021-04-19 14:34:27.916  WARN 1 --- [   scheduling-1] o.a.h.c.protocol.ResponseProcessCookies  : Invalid cookie header: "Set-Cookie: AWSALB=IBgdfz13kcSqIebR9wDO4YsKku18wWVpnUE3SJjeOftddRj3F53UR9JAROlBRszd0rvjkzC5++wCOOvvNbyjEydLjwUeo7VT01zlt89RgskYeAw683mPa3SLKGlM; Expires=Mon, 26 Apr 2021 14:34:27 GMT; Path=/". Invalid 'expires' attribute: Mon, 26 Apr 2021 14:34:27 GMT,
2021-04-19 14:34:27.917  WARN 1 --- [   scheduling-1] o.a.h.c.protocol.ResponseProcessCookies  : Invalid cookie header: "Set-Cookie: AWSALBCORS=IBgdfz13kcSqIebR9wDO4YsKku18wWVpnUE3SJjeOftddRj3F53UR9JAROlBRszd0rvjkzC5++wCOOvvNbyjEydLjwUeo7VT01zlt89RgskYeAw683mPa3SLKGlM; Expires=Mon, 26 Apr 2021 14:34:27 GMT; Path=/; SameSite=None; Secure". Invalid 'expires' attribute: Mon, 26 Apr 2021 14:34:27 GMT,
2021-04-19 14:34:29.969  WARN 1 --- [   scheduling-1] o.a.h.c.protocol.ResponseProcessCookies  : Invalid cookie header: "Set-Cookie: AWSALB=L4KrWVU0sxSV5e0fJm3WsK+zBQBaNrtMnUjY8TuwIIG5B2/IzLHgz4gOWcrG5xFiIkYrHZ4dnIpdiGKDsmdumeOozBFnhC8ue6pPOXFD8V2se9oBRCgQS+K0aTdB; Expires=Mon, 26 Apr 2021 14:34:29 GMT; Path=/". Invalid 'expires' attribute: Mon, 26 Apr 2021 14:34:29 GMT,
2021-04-19 14:34:29.970  WARN 1 --- [   scheduling-1] o.a.h.c.protocol.ResponseProcessCookies  : Invalid cookie header: "Set-Cookie: AWSALBCORS=L4KrWVU0sxSV5e0fJm3WsK+zBQBaNrtMnUjY8TuwIIG5B2/IzLHgz4gOWcrG5xFiIkYrHZ4dnIpdiGKDsmdumeOozBFnhC8ue6pPOXFD8V2se9oBRCgQS+K0aTdB; Expires=Mon, 26 Apr 2021 14:34:29 GMT; Path=/; SameSite=None; Secure". Invalid 'expires' attribute: Mon, 26 Apr 2021 14:34:29 GMT

The HttpClient should not emit those warnings.

Possible Solution

According to this StackOverFlow answer the warning is avoidable by using the following HttpClient configuration:

HttpClient httpClient = HttpClients.custom()
        .setDefaultRequestConfig(RequestConfig.custom()
                .setCookieSpec(CookieSpecs.STANDARD).build())
        .build();

But I haven't found a way to inject the CookieSpec configuration into the Apache HttpClient managed by the SDK.

Your Environment

AWS Java SDK version used: 2.15.60
JDK version used: OpenJDK 11
Operating System and version: Ubuntu Linux 18.04

Actually the warnings are generated only when the application runs in a container not on Ubuntu 18.04.

The container is generated trough a Maven build of a Spring Boot based application that uses Cloud Native BuildPacks (docs here). I don't know exactly which distro is running in the generated container.

I feel this is not really a bug, but a feature request to expose the CookieSpec configuration in the SDK Apache HttpClient.
I'll research more about it, maybe there's a way to configure through an environment variable as a workaround?

I have found no way to configure the CookieSpec via environment variable or system properties

Yeah I couldn't find a way either. We've added this to our backlog, not necessarily a direct access to the CookieSpec config, but a way to fix the warnings you're seeing in the HttpClient.

I am receiving essentially the same warnings while using spark to write to s3.

2021-11-08 16:05:49,121 WARN protocol.ResponseProcessCookies: Invalid cookie header: "Set-Cookie: nspatoken=6571b0bb3a6b9539166515cf26cea582a3b0942b9b9b58e8951fcc4cc6888a47; Expires=Tue, 09 Nov 2021 14:34:20 GMT;SameSite=None;Secure;domain=<private>;path=/;". Invalid 'expires' attribute: Tue, 09 Nov 2021 14:34:20 GMT

message duplicates many times, about 10x per second while writing

using

pyspark 3.1.1
"spark.jars.packages": "com.amazonaws:aws-java-sdk-s3:1.12.105,org.apache.hadoop:hadoop-aws:3.1.1",

add STANDARD cookie spec

Apache 5.1.3 is compliant with RFC 6265 by default. It works!!

<!-- https://mvnrepository.com/artifact/org.apache.httpcomponents.client5/httpclient5 -->
<dependency>
    <groupId>org.apache.httpcomponents.client5</groupId>
    <artifactId>httpclient5</artifactId>
    <version>5.1.3</version>
</dependency>
<!-- https://mvnrepository.com/artifact/org.apache.httpcomponents.client5/httpclient5-fluent -->
<dependency>
    <groupId>org.apache.httpcomponents.client5</groupId>
    <artifactId>httpclient5-fluent</artifactId>
    <version>5.1.3</version>
</dependency>

@AlexFalappa

Hi @AlexFalappa

Thanks for submitting the issue. As of v2.46.0, the SDK's default sync HTTP client is Apache5HttpClient (Apache HttpClient 5.x), which defaults to RFC 6265 cookie handling. The legacy RFC 2109/2965 cookie parsers that produced the Invalid 'expires' attribute warning don't exist in Apache 5, so this warning no longer occurs on the default path.

If you're explicitly using ApacheHttpClient (Apache 4.x), migrating to Apache5HttpClient should resolve this.

Hence, closing this as "not planned", thanks for the report.

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

Navigation Menu

Repository navigation

Warning "Invalid cookie header: ... Invalid 'expires' attribute" #2421

Describe the bug

Possible Solution

Your Environment

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Warning "Invalid cookie header: ... Invalid 'expires' attribute" #2421

Description

Describe the bug

Possible Solution

Your Environment

Activity

AlexFalappa commented on Apr 19, 2021

debora-ito commented on Apr 21, 2021

AlexFalappa commented on Apr 21, 2021

debora-ito commented on Apr 24, 2021

Andrew-Sheridan commented on Nov 8, 2021

hummerstudio commented on Mar 21, 2023

bhoradc commented on Aug 25, 2026

github-actions commented on Aug 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions