On our Tridion 2013 SP1 environment we get the following error message regularly. What can be the issue here?

enter image description here

It occurs when browsing through the CMS.


The issue dissappears when clearing cookies. I don't think there is something wrong with Tridion itself.

I will investigate further.

UPDATE 23-10

Following two cookies are responsible for the error:

enter image description here

Those cookies are set on another website with the same domain. Tridion is on a subdomain of that website.

When those two cookies are set, all requests in Tridion gresult in a 400 or a 500 error. When I remove OR empty the cookie values, the issue is fixed.


An idea came into my mind. I created a test cookie with a comma in it and... Tridion gave the same errors:

enter image description here

So it looks like Tridion can't handle cookies with comma's and braces. Is there a fix for?

  • Can you edit your question and provide some more details about your setup, like are you using SSO, or what Active Directories do you use for your user accounts etc. Oct 17 '17 at 8:30
  • Indeed, the error message hints at some SSO system intercepting the request to the CME backend service. It apparently wants to use the WS-Federation protocol (which is not supported by the CME frontend). Oct 18 '17 at 17:46
  • Hi Bart, Rick. Thank you for your replies. I found out it has something to do with cookies. If I clear cookies the CMS is working again. Oct 19 '17 at 18:44
  • @BartKoopman and Rick, found the real issue! Tridion is going crazy when a cookie is set with a comma or brace in it. Oct 23 '17 at 7:31
  • @PetervanderLugt please self answer your question with your findings, and then after a few days you can accept the answer so the question will be marked as solved. Oct 23 '17 at 7:33

Finally we found the rootcause. The Web Application Proxy (WAP) is very strict in which kind of requests it accepts. According to the standards, a comma value is not allowed, see: https://curl.haxx.se/rfc/cookie_spec.html and https://stackoverflow.com/questions/25387340/is-comma-a-valid-character-in-cookie-value.

So the WAP is blocking all requests after a cookie with an not valid value is set.

So the issue has not to do with Tridion but with the WAP, which is part of our infrastructure. The WAP is not the rootcause, but a script which sets cookies which are not following the standard.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.