When a client runs the Log Scanner in Support Tools in Confluence, the log scanner incorrectly uses the invalid Cookie Header date/timestamp as the date of the log message occurrence. This is naturally confusing to our clients reviewing the log scanner results from STP as the date is in the future and is anomalous to anyone who is viewing the result. How can the logs display an event that has not occurred as of the message? Is it foretelling an issue that will occur?

Steps to reproduce:

1. Any Confluence 6.x instance that has actual data, but has a message in the logs similar to below:

   2017-10-16 09:48:11,800 WARN [http-nio-8090-exec-1] [http.client.protocol.ResponseProcessCookies] processCookies Invalid cookie header: "Set-Cookie: AWSALB=aHSiOsNJMf/+oKt3+cl+OX9ix58T1dN4W7fLHyUID8Vp5srAIepsnDJ8OJXvOvtDWO0qgvD075W4Yb6DR2fr2cDC+Ggswz11nrCmlQ+fy1Wdqs9c0igtN8JfAe8H; Expires=Mon, 23 Oct 2017 13:48:11 GMT; Path=/". Invalid 'expires' attribute: Mon, 23 Oct 2017 13:48:11 GMT
    -- referer: https://confluence.$CLIENT.com/plugins/servlet/gadgets/ifr?container=atlassian&mid=7714768224256&country=GB&lang=en&view=default&view-params=%7B%22writable%22%3A%22false%22%7D&st=atlassian%3AKwQ4mxwrXWMp%2FMmeIv5EEcdD5B%2BglJvITHwMU06YdolFnOq3spJYr1TX0McPhwH5KK7zGJyqaGasYxBrNM1J7C7c7e5jNE5FI8wTWSYHqFX26JXyHGuto9sPZZMur7y69Hkbgidz4TZSwJa0FdwiGxFLrA6kuTvEM9qCvdK6xKx00gv5PdrsYo4GN3rIXrlAvMRFAxMoUUSZeixBARP1uGNkN%2FoSO%2Fi7rm%2Be4egnobjvle%2Bot7QDefcQOtlAryc4X66yJdzbOpRiN%2FdQ0%2BB8Hsd3zPoRrvtIN8oOqACr5qG%2F42Wf%2BmQ2Te9lhF8CAk2Y%2BinaCyhktm8%2FMt57JsxzhHKVPXegoe2yqv8cXBW%2BAdu%2Bbbmh5VXHSI6yixEZ0LuWiwmfUQ%3D%3D&up_isConfigured=true&up_rapidViewId=409&up_showRapidViewName=false&up_sprintId=30347&up_showSprintName=true&up_refresh=120&url=https%3A%2F%2Fjira.$CLIENT.com%2Frest%2Fgadgets%2F1.0%2Fg%2Fcom.pyxis.greenhopper.jira%3Agreenhopper-gadget-sprint-burndown%2Fgadgets%2Fgreenhopper-sprint-burndown.xml&libs=auth-refresh | url: /plugins/servlet/gadgets/makeRequest | traceId: 7343be298ec45e7d | userName: $userName
   

2. Run the log scanner with the above message in the logs
3. Note the bit of the message that is the problem:

   Expires=Mon, 23 Oct 2017 13:48:11 GMT; Path=/". Invalid 'expires' attribute: Mon, 23 Oct 2017 13:48:11 GMT
   

4. Although this date has not yet occurred, the results show this date
5. It appears that the log scanner is seeking the date from the line, ignoring that the date here is not the actual date of occurrence, it simply picked up the second date in the log line and ignored the first when parsing the complete line of code

Workaround

None known at present, appears that this is a code issue with STP.