We've discovered an issue with the latest version of Tomcat 5 (5.5.25) & Tomcat 6 (6.0.16). The problem arises when doing base64 encoding of cookies in our application. When the cookie is encoded, the '=' character is used for padding. When it reaches the browser, the cookie is a valid base 64 encoded cookie and the '=' character is the last character.

However when the application retrieves the cookies sent back from the browser using a simple request.getCookie, we can see that the '=' char has been stripped away. This results in a an error when trying to decode. It could be as a result of the '=' being used as a delimiting character resulting in the request headers being incorrectly parsed.

This is only an issues with the latest versions of Tomcat 5 & 6. Previous version work ok.