Question

I have a weird issue with a php redirect script that does the following:

1. Plant a cookie in the user’s browser, or read the existing cookie if there is one.
2. Redirect the user to another url (the URL for redirect is a parameter in the original URL, e.g. http://my.redir.com?url=www.google.com).
3. Log the redirect (time, user-agent, referrer, cookie).

Every once in a while (very rare, one in millions), I see a cookie that got corrupted in the log file.
All cookies have the format XXXX-XXXX, when the Xs are a-f or 0-9 (so a valid cookie can be 7bfab3-d8694). The corrupted cookies have the characters : or / replacing one of the characters or hyphens, e.g. 7bfa:3-d8694 or 7bfab3/d8694.

The question is, what can cause this?
Can it be a problem with my script or the server it is running on, or is it more likely to be a problem in the user’s browser?

— more info —

The corrupted cookies I have found had the user-agents:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Sky Broadband; GTB7.1; Sky Broadband; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; Sky Broadband)
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_4_11; en) AppleWebKit/533.19.4 (KHTML, like Gecko) Version/4.1.3 Safari/533.19.4

Answer 1

All kinds of “scrapping” robots are badly written, full of bugs. I see similar behavior in my logs, e.g. poor (incorrect) HTML parsers following links incorrectly, “sanitizing” or URL-encoding and URL-decoding stuff in a wrong way, etc.

All this while the “agent” string looks like regular browser. I was freaked by this once, until I noticed how several hundred different pages were hit in a matter of seconds. No chance this is a human being just surfing.

So I suggest you try to see in your logs what else this IP/agent combination was visiting, and if this is a robot, stop worrying about it.