为此cookie指定了无效域

Question

我在我的应用程序中使用Spring Boot 1.4.4.RELEASE,我的应用程序已部署在AWS中.

我想为每个用户提供子域名,比如

当用户"test"登录时,url将为test.XXX.com

这里XXX.com是我的域名.

对于XXX.com,它工作正常.

我最近再买了一个像XXX-test.com这样的测试域名.

但是,当用户登录时,我收到以下异常.

java.lang.IllegalArgumentException: An invalid domain [.XXX-test.com] was specified for this cookie
    at org.apache.tomcat.util.http.Rfc6265CookieProcessor.validateDomain(Rfc6265CookieProcessor.java:183)
    at org.apache.tomcat.util.http.Rfc6265CookieProcessor.generateHeader(Rfc6265CookieProcessor.java:125)
    at org.apache.catalina.connector.Response.generateCookieString(Response.java:989)
    at org.apache.catalina.connector.Response.addSessionCookieInternal(Response.java:959)
    at org.apache.catalina.connector.Request.doGetSession(Request.java:3009)
    at org.apache.catalina.connector.Request.getSession(Request.java:2367)
    at org.apache.catalina.connector.RequestFacade.getSession(RequestFacade.java:896)
    at javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:231)
    at org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper.createNewSessionIfAllowed(HttpSessionSecurityContextRepository.java:427)
    at org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper.saveContext(HttpSessionSecurityContextRepository.java:364)
    at org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper.onResponseCommitted(SaveContextOnUpdateOrErrorResponseWrapper.java:85)
    at org.springframework.security.web.util.OnCommittedResponseWrapper.doOnResponseCommitted(OnCommittedResponseWrapper.java:245)
    at org.springframework.security.web.util.OnCommittedResponseWrapper.sendRedirect(OnCommittedResponseWrapper.java:127)
    at javax.servlet.http.HttpServletResponseWrapper.sendRedirect(HttpServletResponseWrapper.java:138)
    at org.springframework.security.web.util.OnCommittedResponseWrapper.sendRedirect(OnCommittedResponseWrapper.java:128)
    at org.springframework.security.web.DefaultRedirectStrategy.sendRedirect(DefaultRedirectStrategy.java:57)

我的Spring application.properties,

server.session.cookie.domain=.XXX-test.com
server.session.cookie.path=/

它适用于其他prod env与以下配置.

server.session.cookie.domain=.XXX.com
server.session.cookie.path=/

同样,几个月前使用1.3.5的spring boot版本部署和测试了prod配置.

这里有什么改变或遗失的东西吗？或者,XXX-test.com是个问题？

谢谢,

Answer 1

根据RFC 6265(https://tools.ietf.org/html/rfc6265)开头.性格可能会导致问题.

您可以尝试回退到LegacyCookieProcessor,请参阅:如何将Cookie处理器更改为tomcat 8中的LegacyCookieProcessor以获取更多信息.

如果您仍有问题,请告知我们您的TC版本.