You can identify non-ASCII cookies using the IIS rewrite rule, and then redirect the user to a static HTML page and delete or rewrite the cookie. (I tested this with CF10 and it works.)
This non-ASCII cookie kills ColdFusion10 / 11. (NOTE: ColdFusion can only access cookie names with a top location.)
document.cookie="a=ñ";
Add this to your IIS web.config file.
<rule name="Route Bad Cookie" enabled="true" stopProcessing="true"> <match url="^(.*)" /> <conditions logicalGrouping="MatchAll"> <add input="{PATH_INFO}" pattern=".*htm$" negate="true" /> <add input="{HTTP_COOKIE}" pattern="([^\x00-\x7F]+)" /> </conditions> <action type="Redirect" url="/clearCookie.htm" redirectType="Temporary"/> </rule>
NOTE. The above rule matches any script files except “.htm” (if you are already using IIS Rewrite to hide .CFM in your URLs.)
<match url="*.cfm*" />
If you are aware of security, you can replace the rewrite action with abort .
<action type="AbortRequest" />
or custom answer:
<action type="CustomResponse" statusCode="403" statusReason="Forbidden: Invalid non-ASCII cookie" statusDescription="Only US-ASCII characters excluding CTLs, whitespace, DQUOTE, comma, semicolon, and backslash are allowed in a cookie." />
Here is a sample cookie removal code (/clearCookie.htm):
<script> var mydate = new Date(); mydate.setTime(mydate.getTime() - 1); document.cookie = "a=; expires=" + mydate.toGMTString(); </script>
James moberg
source share