title: Spring Boot: RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"
body: <p>I get the following exception when I POST the login credentials for my Spring Boot app.</p>
  
  <blockquote>
    <p>org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"</p>
  </blockquote>
  
  <p>It is posting to <code>/dologin</code> and then redirecting to <code>/home</code> with the <code>jsessionid</code> appended to the end. It does also set the session cookie too. I did not change any session settings and there is no mention of <code>session</code> in <code>application.properties</code>. </p>
  
  <p>I tried to set </p>
  
  <pre><code>server.servlet.session.cookie.http-only=true
  server.servlet.session.tracking-modes=cookie
  </code></pre>
  
  <p>As mentioned in <a href="https://stackoverflow.com/a/31792535/148844">https://stackoverflow.com/a/31792535/148844</a>, but it didn't work.</p>
  
  <p>I added</p>
  
  <pre><code>@Bean
  public ServletContextInitializer servletContextInitializer() {
      return new ServletContextInitializer() {
          @Override
          public void onStartup(ServletContext servletContext) throws ServletException {
             servletContext.setSessionTrackingModes(Collections.singleton(SessionTrackingMode.COOKIE));
             SessionCookieConfig sessionCookieConfig=servletContext.getSessionCookieConfig();
             sessionCookieConfig.setHttpOnly(true);
          }
      };
  }
  </code></pre>
  
  <p>But now it just POSTs, sets the cookie, and redirects back to the login screen. It's as if it can't access the session.</p>
  
  <p>I set <code>server.session.tracking-modes=cookie</code> (instead of <code>server.servlet...</code>) and it is only using cookies now, but the Chrome browser is not sending the cookie back to the server after login! <code>/home</code> action will only re-display the login page if <code>user</code> attribute in the session is null.</p>
  
  <pre><code>POST /dologin HTTP/1.1
  Host: localhost:8080
  Origin: http://localhost:8080
  Upgrade-Insecure-Requests: 1
  Referer: http://localhost:8080/home
  
  HTTP/1.1 302
  Set-Cookie: JSESSIONID=3B82AAA40CE94FF490FBF7B4DBD837DD; Path=/; HttpOnly
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  Location: http://localhost:8080/home
  
  GET /home HTTP/1.1
  Host: localhost:8080
  Upgrade-Insecure-Requests: 1
  Referer: http://localhost:8080/home
  
  HTTP/1.1 200
  Set-Cookie: JSESSIONID=B60BF649068F7E85346691FD2F5D119B; Path=/; HttpOnly
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  Content-Type: text/html;charset=UTF-8
  Content-Language: en-US
  Content-Length: 2742
  Date: Sat, 29 Sep 2018 17:41:55 GMT
  </code></pre>
  
  <p>Notice the cookies are different and Chrome did not send the cookie back to the server? Why?</p>
  
  <p>Spring Boot 1.5.13, Chrome Version 69.0.3497.100 (Official Build) (64-bit)</p>