Don't throw an exception in CookieLocaleResolver, fallback to default locale instead

[darioseidl]

Affects: Spring Framework 5.1.2

In the CookieLocaleResolver, would it be possible to ignore the parsing error altogether instead of throwing an IllegalStateException? Basically, I would want the CookieLocaleResolver to return the locale from the cookie, if valid, or the default locale otherwise - never throwing an exception.

It's easy enough to write a custom CookieLocaleResolver, but this seems like a bug to me. When a user has an invalid locale cookie it should not break anything, just fallback to the default locale.

This is similar to #19748 where the exception was swallowed for when it's an error dispatch.

[jhoeller]

This really depends on whether cookie values are seen as input parameters (along the lines of query parameters or path variables) or rather as supplementary values that can simply be ignored if invalid. I suppose we could easily allow for the latter through a configuration setting on CookieLocaleResolver.

[darioseidl]

I suppose we could easily allow for the latter through a configuration setting on CookieLocaleResolver

That would be great. In our case, the frontend would be responsible for setting a correct value but if it doesn't, the backend should simply fallback to defaults.

If in the CookieLocaleResolver the throw new IllegalStateException could simply be skipped, it would proceed to this part

request.setAttribute(LOCALE_REQUEST_ATTRIBUTE_NAME, 
        (locale != null ? locale : determineDefaultLocale(request)));
request.setAttribute(TIME_ZONE_REQUEST_ATTRIBUTE_NAME,
        (timeZone != null ? timeZone : determineDefaultTimeZone(request)));

which would be correctly setting the default locale and timezone.

[jhoeller]

Alright, I've introduced a corresponding rejectInvalidCookies flag which is on by default but can be turned off for lenient handling of parse failures.

[darioseidl]

Thanks for the quick fix!