Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[BUG] At Least Some Special Characters are Allowed in ai_user and ai_session Cookie Values

See original GitHub issue

Description/Screenshot I recently observed that forward-slash (/) and plus sign (+) characters are there in the sdk generated random identifiers. As mentioned in the documentation, app insights SDK track these values in ai_user and ai_session cookies. Recently one of our request was get blocked by Azure WAF rules because the ai_session cookie was containing a illegal value. The value was something like,

RqjfPhfhetEwksnxdxnvxhje4/ls|3425564716255|3426573612432

which contains /ls in the value, which we believe the reason for the WAF block. (Please note this is a modified cookie value)

ls is a command use by Unix-like operating systems.

Issue Analytics

State:
Created 2 years ago
Comments:5 (2 by maintainers)

Top GitHub Comments

1reaction

MSNevcommented, Aug 27, 2021

Yes anything can be inside a cookie, cookies are not “executed”

0reactions

github-actions[bot]commented, Aug 31, 2022

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

Top Results From Across the Web

What are allowed characters in cookies? - Stack Overflow

According to the ancient Netscape cookie_spec the entire NAME=VALUE string is: a sequence of characters excluding semi-colon, ...

ApplicationInsights-JS/aisdk.0.0.17.js.map at master - GitHub

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may...

microsoft/applicationinsights-web-basic - UNPKG

ES3 only, IE8 just in case any page checks for presence/absence of the ... 5 symbols in base64, almost maxint\r\n while (random >...

Viewing online file analysis results for 'IPFilter.exe'

IPFilter.exe. This report is generated from a file or URL submitted to this webservice on November 17th 2018 05:04:19 (UTC) and action script...

Renovate Bot Package Diff

- Use this method for sending error telemetry as traditional events to App Insights. This method will automatically drop error properties in certain...