Post upgrade to 4.2.1 - Invalid cookie header

[Jay Fowler]

After upgrading from 3.3.x to 3.4.x, there was a new "cookie" error message
in our idp-process.log.  Upgrading to 4.2.1 didn't resolve this issue.

Unrelated to shibboleth forums, but perhaps relevant were other posts
describing stricter CookieSpecs, the apache HTTP client libraries, sticky
sessions with LBs and even the OS locale settings.

It seems to happen when metadata is pulled from remote sites, in particular
with AWS load balancers.  At this point, i'm not sure if it is a bug or
something that needs adjusting in my configs, so wondering if others have
come across it and any guidance around troubleshooting or resolving
further.

Maybe i am missing something from here?
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631724/HttpClientConfiguration

Jay

===================
# /opt/shibboleth-idp/bin/version.sh
4.2.1

# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.6 (Ootpa)

# java -version
openjdk version "11.0.15" 2022-04-19 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.15+10-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.15+10-LTS, mixed mode, sharing)

# java -jar $JETTY_HOME/start.jar --list-config
jetty.version = 9.4.48.v20220622

# from the war file
/some/path/lib/httpclient-4.5.13.jar

idp-process.log:

WARN [org.apache.http.client.protocol.ResponseProcessCookies:130] - Invalid
cookie header: "Set-Cookie: AWSALB=...Expires=Wed, 13 Jul 2022 18:54:05
GMT; Path=/". Invalid 'expires' attribute: Wed, 13 Jul 2022 18:54:05 GMT

WARN [org.apache.http.client.protocol.ResponseProcessCookies:130] - Invalid
cookie header: "Set-Cookie: AWSALBCORS=...Expires=Wed, 13 Jul 2022 18:54:05
GMT; Path=/; SameSite=None; Secure". Invalid 'expires' attribute: Wed, 13
Jul 2022 18:54:05 GMT

=======================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220706/83c0c6b0/attachment.htm>