Home/ Questions/Q 6826885
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T22:12:03+00:00

Disclaimer: I’m not a Java guy, but ended up having to maintain some Java

  • 0

Disclaimer: I’m not a Java guy, but ended up having to maintain some Java code.

I was recently trying to debug why a Java server was returning status code 500 on certain requests. I narrowed it down to some code that essentially did:

httpServletResponse.addHeader("Set-Cookie", "FOO=BAR; domain=localhost")

If if replaced domain=localhost with the domain from the URL, it worked. If I just removed that line of code, it also worked.

I found this rather surprising. I’d expect the browser to ignore such a cookie line, or at the least not have the whole server blow up. Searching around, I couldn’t find any documentation about any such constraints. Is this expected/documented behavior somewhere?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    After enough digging and logging, I eventually tracked this down to the specific servlet server implementation I’m using, which really doesn’t like domain=localhost.

    What I was really after was some specification that said something like, “Set-cookie with a bad domain value should result in a 500 server error”, or otherwise directly addressed the problem of “what servlets should do if a bad cookie domain is given in Set-Cookie.”

    • 0