【障害情報】アプリケーションでHttpOnly属性をCookieに付与するとHTTPレスポンスの欠落が発生する問題(WAS-10-00I)

Troubleshooting

Problem

IBM WebSphere Application Server (以下、WAS）に関する次の重要情報が報告されています。当技術文書はIBMソフトウェア・サポートでの問題判別の過程で判明した情報（発生条件、回避策、対応策）についてお知らせするものです。当技術文書の内容をもとに回避策の実施または最新のFix Packの適用をご検討ください。

Symptom

Resolving The Problem

WAS V7.0/V6.1において、アプリケーションでHttpOnly属性を持ったCookieを複数付与すると、HTTPレスポンスの欠落が発生する問題が報告されました。これにより、Webサーバー・プラグインはアプリケーション・サーバーを誤ってダウンと検知してしまいます。解決策をご参照いただき、Fix Packを適用してください。

【内容】
WebアプリケーションがSet-CookieヘッダーでCookieを複数付与する際、いずれのCookieにもHttpOnly属性（*1）がある場合、Webコンテナ内部で例外が発生し、HTTPレスポンス中のHTTPステータスコードとHTTPヘッダーが欠落する不具合が発生します。
Webサーバー・プラグインを経由する場合は、プラグインはアプリケーション・サーバーが利用不能と判断し、クラスター環境の場合は他のサーバーでのリクエスト実行を試みた後、クライアントにHTTPステータスコード500（Internal Server Error)を返信します。
また、Webサーバーおよびプラグインが配置されていないトポロジーでは、Webコンテナが生成したHTTPステータス・コードとHTTPヘッダーが含まれない不正なHTTPレスポンスがそのままクライアントに送付されるため、アプリケーションの意図しない動作になります。

以下のようなException がFFDCログに記録されます。
----------------------------------------------
FFDC Exception:java.lang.ClassCastException SourceId:com.ibm.ws.http.channel.inbound.impl.HttpInboundServiceContextImpl.formatHeaders ProbeId:1859 Reporter:com.ibm.ws.http.channel.inbound.impl.HttpInboundServiceContextImpl@4c714c71
java.lang.ClassCastException: java.lang.String incompatible with javax.servlet.http.Cookie
at com.ibm.ws.http.channel.impl.HttpBaseMessageImpl.parseAllCookies(HttpBaseMessageImpl.java:2988)
at com.ibm.ws.http.channel.impl.HttpBaseMessageImpl.marshallCookieCache(HttpBaseMessageImpl.java:2619)
at com.ibm.ws.http.channel.impl.HttpBaseMessageImpl.preMarshallMessage(HttpBaseMessageImpl.java:2671)
at com.ibm.ws.genericbnf.impl.GenericMessageImpl.marshallMessage(GenericMessageImpl.java:376)
at com.ibm.ws.http.channel.impl.HttpServiceContextImpl.formatHeaders(HttpServiceContextImpl.java:1951)
at com.ibm.ws.http.channel.impl.HttpServiceContextImpl.prepareOutgoing(HttpServiceContextImpl.java:2146)
at com.ibm.ws.http.channel.impl.HttpServiceContextImpl.sendOutgoing(HttpServiceContextImpl.java:2192)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundServiceContextImpl.sendResponseBody(HttpInboundServiceContextImpl.java:865)
at com.ibm.ws.webcontainer.channel.WCChannelLink.writeBufferAsynch(WCChannelLink.java:474)
at com.ibm.ws.webcontainer.channel.WCChannelLink.writeBufferResponse(WCChannelLink.java:451)
at com.ibm.ws.webcontainer.channel.WCChannelLink.writeBuffer(WCChannelLink.java:395)
at com.ibm.ws.webcontainer.channel.WCCByteBufferOutputStream.flushWriteBuffer(WCCByteBufferOutputStream.java:406)
at com.ibm.ws.webcontainer.channel.WCCByteBufferOutputStream.write(WCCByteBufferOutputStream.java:143)
at com.ibm.ws.webcontainer.srt.SRTOutputStream.write(SRTOutputStream.java:97)
:
----------------------------------------------

*1 HttpOnly とは、
クロスサイト・スクリプティングのリスクを軽減するために Microsoft Internet Explorer 6 で導入されました。HttpOnly 属性を持つ Cookie には、
JavaScript経由でアクセスできなくなるため、Cookie に格納されている情報の盗聴のリスクを軽減できます。

参考：
Mitigating Cross-site Scripting With HTTP-only Cookies (外部サイト)
http://msdn.microsoft.com/en-us/library/ms533046.aspx

【対象ソフトウェア】
対象プラットフォーム：分散系全てのプラットフォーム（AIX、Linux、Windows、Solaris、HP-UX）、i5/OS
対象バージョン： V7.0.0.0～V7.0.0.9 もしくは V6.1.0.0～V6.1.0.29
対象エディション：全てのエディション

【発生条件】
下記の条件全てを満たす場合に該当します。
1. WAS V7.0.0.0～V7.0.0.9 もしくは　V6.1.0.0～V6.1.0.29 を使用している
2. WebアプリケーションでCookieにHttpOnly属性をセットしている（*2）
3. 複数のCookieヘッダーをセットしており、全て条件2を満たしている

*2 具体的には、Cookie を発行する際に、「Set-Cookie: (中略) HttpOnly 」として設定します。

【回避策】
ありません。

【対応策】
WAS 7.0 Fix Pack 11（V7.0.0.11） / WAS 6.1 Fix Pack 31（V6.1.0.31）以上を適用（*3）することで、アプリケーション・サーバー（HTTP Channel）でCookie属性が正しく処理されるようになります。　

*3 Webサーバー・プラグインではなく、アプリケーション・サーバー（AppServer）のコード修正のため、アプリケーション・サーバーのFix Packを適用する必要があります。ただし、プラグインのバージョンは、アプリケーション・サーバーと同等もしくはそれより高いものである必要があるため、プラグインのバージョンが低い場合は、プラグインの修正も同時に適用してください。

分散系プラットフォーム（AIX、Linux、Windows、Solaris、HP-UX）の場合
Fix Packの出荷状況は下記のURLをご参照ください。
Recommended fixes for WebSphere Application Server
http://www.ibm.com/support/docview.wss?uid=swg27004980

i5/OSの場合
グループPTFの出荷状況は下記のURLをご参照ください。
IBM WebSphere Application Server for IBM i: PTFs
http://www.ibm.com/systems/i/software/websphere/services/service.html

【関連情報】
・WAS 7.0 - PM12049: WHEN TWO OR MORE "SET-COOKIE" HEADERS ARE PRESENT, AN ATTRIBTE　MAY NOT BE PASSED WITH THE COOKIE TO THE CLIENT
http://www.ibm.com/support/docview.wss?uid=swg1PM12049

・WAS 6.1 - PM11211: WHEN TWO OR MORE "SET-COOKIE" HEADERS ARE PRESENT, AN ATTRIBTE MAY NOT BE PASSED WITH THE COOKIE TO THE CLIENT
http://www.ibm.com/support/docview.wss?uid=swg1PM11211

・バージョン確認方法
【FAQ】WAS V4, V5, V6, V7でのバージョン、Fixレベル確認方法
http://www.ibm.com/jp/domino01/mkt/websphere.nsf/doc/0021E39C

・WAS V7.0の修正情報一覧
【Fix list for IBM WebSphere Application Server version 7.0】
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27014463

・最新のFix Pack(for AIX, Windows, Linux, Solaris, HP-UX, IBM i(i5/OS))
【Recommended fixes for WebSphere Application Server】
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

・最新のFix Pack(for IBM i(i5/OS))
【IBM WebSphere Application Server for IBM i: PTFs】
http://www.ibm.com/systems/i/software/websphere/services/service.html

・IBM Support: Fix Central
http://www.ibm.com/support/fixcentral/

【変更履歴】
2010年11月05日外部公開しました。

[{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Not Applicable","Platform":[{"code":"","label":"zSeries"},{"code":"","label":"iSeries"},{"code":"","label":"pSeries"},{"code":"","label":"xSeries"},{"code":"","label":"SUN"},{"code":"","label":"HP"}],"Version":"All","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SS7JFU","label":"WebSphere Application Server - Express"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SS6JMN","label":"WebSphere Application Server Community Edition"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSR2SE","label":"WebSphere Application Server Feature Pack for Web 2.0"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSCKBL","label":"WebSphere Application Server Hypervisor Edition"},"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}},{"Product":{"code":"SSCKBL","label":"WebSphere Application Server Hypervisor Edition"},"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}},{"Product":{"code":"SSNNA3","label":"WebSphere Application Server V7 Feature Pack for Communications Enabled Applications"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSV8AP","label":"WebSphere Application Server V7 Feature Pack for OSGi Applications and Java Persistence API 2.0"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSNN92","label":"WebSphere Application Server V7.0 Feature Pack for XML"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSCKAP","label":"WebSphere CloudBurst Appliance"},"Business Unit":{"code":"BU053","label":"Cloud \u0026 Data Platform"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB36","label":"IBM Automation"}},{"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSTVLU","label":"WebSphere eXtreme Scale"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SS2P3U","label":"WebSphere IP Multimedia Subsystem Connector"},"Business Unit":{"code":"BU055","label":"Cognitive Applications"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"","label":""}},{"Product":{"code":"SSSTCZ","label":"WebSphere Real Time"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SSUNCX","label":"WebSphere Remote Server"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}},{"Product":{"code":"SUPPORT","label":"IBM Worldwide Support"},"Business Unit":{"code":"BU051","label":"N\/A"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB33","label":"N\/A"}},{"Product":{"code":"SUPPORT","label":"IBM Worldwide Support"},"Business Unit":{"code":"BU051","label":"N\/A"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB33","label":"N\/A"}},{"Product":{"code":"SSUP64","label":"IBM WebSphere Virtual Enterprise"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":null,"Platform":[{"code":"","label":""}],"Version":"","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Historical Number

0E7D69C208C521B7492577B50032B1E8

Was this topic helpful?

Document Information

Modified date:
08 September 2022

UID

jpn1J1001622

Tips