Jetty configuration in GoogleAppEngine Standard - google-app-engine

Question

I tried <env-var name="JETTY_PROPERTIES" value="httpConfig.requestCookieCompliance=RFC2965,jetty.httpConfig.responseCookieCompliance=RFC2965"/> in appengine-web.xml hoping that the advice in https://cloud.google.com/appengine/docs/flexible/java/dev-jetty9 would work for standard environment too. No luck. How do I set Jetty configuration in Google App Engine Standard?

Answer 1

The environment variable JETTY_PROPERTIES was introduced for GAE Flexible Environment.
It doesn't exist for the older GAE Standard Environment.
Depending on your runtime, you might still be on Jetty 9.3.x, in which case those properties you are attempting to set do not even exist there (they were introduced in Jetty 9.4.9.v20180320)
For GAE Flexible Runtime see ...
See: https://github.com/GoogleCloudPlatform/jetty-runtime
The bash script responsible for reading that <env-var> is 50-jetty.bash -
https://github.com/GoogleCloudPlatform/jetty-runtime/blob/master/jetty9/src/main/docker/50-jetty.bash#L36-L38
The behavior of Cookie Compliance in Jetty codebase
⚠️ There is no RFC2109 support, as it contains far too many security issues to be safe.
RFC6265 - Default Behavior
Generation
(eg: Server-side Set-Cookie response header, or Client-side Cookie request header)
Name must be valid per RFC2616 token rules (US-ASCII, 7-bit, excluding control characters, and separators)
Value must be valid per RFC6265 value rules (US-ASCII, 7-bit, excluding control characters, whitespace, DQUOTE ", comma ,, semicolon ;, and backslash \)
Does not generate Version=# entry
Does not generate Comment= entry
Does not generate "$" entries (like $Version, $Domain, $Port, and $Version entries)
Generates the following entries
Path
Domain
Expires
Max-Age
Secure
HttpOnly
SameSite
Parsing
(eg: Server-side Cookie request header, or Client-side Set-Cookie response header)
Lenient parser based on industry recommendations for safe Cookie parsing behaviors - RFC6265 - Example parsing behavior: CookieCutterLenientTest
Name must be valid per RFC2616 token rules (US-ASCII, 7-bit, excluding control characters, and separators) - will REJECT cookie if fails (meaning the Cookie doesn't show up in resulting Cookie list)
Value must be valid per RFC6265 value rules (US-ASCII, 7-bit, excluding control characters, whitespace, DQUOTE ", comma ,, semicolon ;, and backslash \) - will REJECT cookie if fails
Value allows DQUOTE during parsing, but it must be supported by matching DQUOTE at end of value. - will REJECT cookie if fails (meaning the Cookie doesn't show up in resulting Cookie list)
Ignores "$" named entries (like $Version, $Domain, $Port, and $Version entries)
Does not allow more then 1 cookie declaration per Cookie header (the ancient "comma delim" approach from HTTP/1.0 days)
RFC2965 - Alternate Behavior
Generation
(eg: Server-side Set-Cookie response header, or Client-side Cookie request header)
Name must be valid per RFC2109 rules (US-ASCII, 7-bit, excluding control characters, delimiters, DQUOTE, comma, semi-colon, backslash, space, and horizontal tab)
Name will be surrounded by DQUOTE if delimiters are present. (⚠️ if delimiters are present here most modern browsers will reject this entire cookie)
Value must be valid per RFC2109 value rules (US-ASCII, 7-bit, excluding control characters, delimiters, DQUOTE, comma, semi-colon, backslash, space, and horizontal tab)
Value will be surrounded by DQUOTE if delimiters are present. (⚠️ if delimiters are present here most modern browsers will reject this entire cookie)
Does not generate "$" entries (like $Version, $Domain, $Port, and $Version entries)
⚠️ Does not generate SameSite entry
Generates the following entries
Version
Path
Domain
Expires
Max-Age
Secure
HttpOnly
Comment
Parsing
(eg: Server-side Cookie request header, or Client-side Set-Cookie response header)
Name must be valid per RFC2109 token rules (US-ASCII, 7-bit, excluding control characters, and separators) - any violation will result in unpredictable results (like splitting a cookie at the wrong delimiter)
Value must be valid per RFC6265 value rules (US-ASCII, 7-bit, excluding control characters, whitespace, DQUOTE ", comma ,, semicolon ;, and backslash \) - any violation will result in unpredictable results (like splitting a cookie at the wrong delimiter)
Value allows DQUOTE during parsing, but it must be supported by matching DQUOTE at end of value. - any violation will result in unpredictable results (like splitting a cookie at the wrong delimiter)
Parses "$" named entries (like $Version, $Domain, $Port, and $Version entries)
Note: $Port is reported in the Comment of the resulting parsed Cookie.
Allows more then 1 cookie declaration per Cookie header (the ancient "comma delim" approach from HTTP/1.0 days)
⚠️ Does not parse SameSite entry