java.lang.IllegalArgumentException: Invalid character found in the request target

[Jack Tauson]

I am making a POST call like this from POSTMAN (screenshot below):



And as soon as I am making a call, I am getting following error:

2020-09-24 17:10:26.813  INFO 61036 --- [nio-8080-exec-8] o.apache.coyote.http11.Http11Processor   : Error parsing HTTP request header
 Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level.

java.lang.IllegalArgumentException: Invalid character found in the request target [/Downloader/download?p_user_id=JACK&p_user_application= test%20application&p_identifier=31150&p_path_list=\ABC10PCS_2015AA\&p_in_project_title=test%20title&p_in_project_description=test%20description&p_in_intended_use=testuse&personnel_id=12345]. The valid characters are defined in RFC 7230 and RFC 3986
	at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:500) ~[tomcat-coyote.jar:8.5.58]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:503) ~[tomcat-coyote.jar:8.5.58]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) [tomcat-coyote.jar:8.5.58]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:818) [tomcat-coyote.jar:8.5.58]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1626) [tomcat-coyote.jar:8.5.58]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-coyote.jar:8.5.58]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_241]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_241]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-util.jar:8.5.58]
	at java.lang.Thread.run(Thread.java:748) [na:1.8.0_241]

Not sure why it is happening. My database guy just updated the stored procedure name that I am calling by calling the /download endpoint so I just updated the stored procedure name and a parameter name in the code. It used to work fine before making any changes.

I researched online and some people mentioned that it could be tomcat issue so I switched from version 9 to 8.5.58 locally in eclipse and it's still happening. What might be wrong?

[Dave Tolls]

Looks like '\' hasn't been encoded.

[Stephan van Hulst]

There's also a spurious space after the '=' of the p_user_application part of the query string.

[Jack Tauson]

Stephan van Hulst wrote:There's also a spurious space after the '=' of the p_user_application part of the query string.

Not sure. Made some changes and it's still throwing same error:

 [/Downloader/download?p_in_user_id=JACK&p_in_user_application=userapp&p_identifier=31398&p_path_list=\\HCUPS_DX\\16\\16-12\\%0A|%0A\\Laboratory\\%0A&p_in_project_title=Title%201250&p_in_project_description=Description%201250&p_in_intended_use=Recruitment&personnel_id=12345]. The valid characters are defined in RFC 7230 and RFC 3986

I used to send the parameters in same fashion before without any issues.

java.lang.IllegalArgumentException: Invalid character found in the request target [/Downloader/download?p_in_user_id=JACK&p_in_user_application=userapp&p_identifier=31398&p_path_list=\\HCUPS_DX\\16\\16-12\\%0A|%0A\\Laboratory\\%0A&p_in_project_title=Title%201250&p_in_project_description=Description%201250&p_in_intended_use=Recruitment&personnel_id=12345]. The valid characters are defined in RFC 7230 and RFC 3986
	at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:500) ~[tomcat-coyote.jar:8.5.58]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:503) ~[tomcat-coyote.jar:8.5.58]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) [tomcat-coyote.jar:8.5.58]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:818) [tomcat-coyote.jar:8.5.58]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1626) [tomcat-coyote.jar:8.5.58]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-coyote.jar:8.5.58]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_241]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_241]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-util.jar:8.5.58]
	at java.lang.Thread.run(Thread.java:748) [na:1.8.0_241]

Also tried removing space from the values of parameters p_in_project_title and p_in_project_description. No luck so far.

[Rob Spoor]

Dave Tolls wrote:Looks like '\' hasn't been encoded.

I'm quoting this because it's still true.

[Jack Tauson]

Rob Spoor wrote:

Dave Tolls wrote:Looks like '\' hasn't been encoded.

I'm quoting this because it's still true.

Should I do it like this (encode \ as %5C):

%5CABC10PCS_2015AA%5C

[Stephan van Hulst]

What happened when you tried it?

[Paul Clapham]

Jack Tauson wrote:Should I do it like this (encode \ as %5C):

%5CABC10PCS_2015AA%5C

Well, yes and no. You should just be URL-encoding all of the parameter values of your URL, is what you should be doing. Not asking whether specific characters should be encoded.

[Jack Tauson]

Stephan van Hulst wrote:What happened when you tried it?

This worked fine. The eclipse didn't complain. Characters showed up as \ in the database.

[Jack Tauson]

Paul Clapham wrote:

Jack Tauson wrote:Should I do it like this (encode \ as %5C):

%5CABC10PCS_2015AA%5C

Well, yes and no. You should just be URL-encoding all of the parameter values of your URL, is what you should be doing. Not asking whether specific characters should be encoded.

I believe when you say "URL-encoding of all of the parameter values", you mean I should do it at the time of calling the end point from UI? OR is there a way to do it in POSTMAN client as well? Thanks !

[Stephan van Hulst]

I'm pretty sure that Postman has some kind of control where you can enter request parameters and if the request is a GET request, Postman will encode the parameters in the URL for you. You shouldn't put parameters in the URL manually.

However, it appears that you are performing a request that modifies your application state. You must not use a GET request for this, but instead a POST or PUT request. The data that you want to store in the database should not be part of the URL, but rather of the request body.

[Jack Tauson]

Stephan van Hulst wrote:I'm pretty sure that Postman has some kind of control where you can enter request parameters and if the request is a GET request, Postman will encode the parameters in the URL for you. You shouldn't put parameters in the URL manually.

However, it appears that you are performing a request that modifies your application state. You must not use a GET request for this, but instead a POST or PUT request. The data that you want to store in the database should not be part of the URL, but rather of the request body.

Thank you.

The data that you want to store in the database should not be part of the URL, but rather of the request body.

I was thinking about this. I would appreciate if I could get some more advise on this.

While calling the download endpoint, I am calling the stored procedure in my code and that needs parameters and hence I decided to use it like GET request. I mean, the data which is the part of the URL is not directly getting saved into the database. Could you tell me if this scenario is still good or do I still need to consider sending the data as a part of request body? Thanks again !

[Stephan van Hulst]

A GET request is appropriate.