title: Weird malformed cookies returned from REST api (sometimes)
body: <p>I have an interesting problem - <strong>sometimes</strong> malformed cookies are returned from my web API hosted on AWS (.NET Core 2.2), behind Incapsula WAF and AWS elb. This messes up my .NET framework SDK which throws exception when trying to parse headers complaining about server doing protocol violation (suggestions are usually this: <a href="https://weblog.west-wind.com/posts/2007/Mar/29/The-server-committed-a-protocol-violation-with-WebRequest" rel="nofollow noreferrer">https://weblog.west-wind.com/posts/2007/Mar/29/The-server-committed-a-protocol-violation-with-WebRequest</a> - setting useUnsafeHeaderParsing to true).</p>
  
  <p>In fiddler, I managed to figure out the problem (likely):
  <a href="https://i.stack.imgur.com/1IeGj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1IeGj.png" alt="Fiddler screenshot"></a></p>
  
  <p>Anyone knows where these cookie headers come from? (as you can see some headers are added by AWS/WAF), but they don't seem to be the problem.
  Important: those __utm* cookies are only set sometimes. Googling it, only points to possible GA cookies, but they seem different (already checked <a href="https://www.webtrafficexchange.com/google-analytics-cookies-utma-utmb-utmz" rel="nofollow noreferrer">https://www.webtrafficexchange.com/google-analytics-cookies-utma-utmb-utmz</a>)</p>