add caution about client influence and delims

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936255 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml
index 1b9dce0d7b2b358d1cb649bef534c6fea50155d4..aa69daf326f31832c6427c69ae3908f4167528b3 100644 (file)
--- a/docs/manual/rewrite/flags.xml
+++ b/docs/manual/rewrite/flags.xml
@@ -350,6 +350,13 @@ follows:</p>
 [CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite]
 </example>
 
+<note type="warning">
+<title>Security Warning</title>
+<p>Exercise care when constructing the argument from backreferences or other
+variable expansion.  If any part of the argument is derived from user input,
+a malicious request may include delimeters or other unexpected values.</p>
+</note>
+
 <p>If a literal ':' character is needed in any of the cookie fields, an 
 alternate syntax is available.  To opt-in to the alternate syntax, the cookie 
 "Name" should be preceded with a ';' character, and field separators should be