The number of cookies sent exceeded the maximum of 200 错误

自己用Jfinal4.8做了一个简单的中医参考网站，但是每天都有很多报错。大部分都是
The number of cookies sent exceeded the maximum of 200。
具体异常信息如下：

2020-09-11 09:34:25,ERROR,[Thread: XNIO-1 task-47],[io.undertow.servlet.api.LoggingExceptionHandler.handleThrowable()],UT005023: Exception handling request to /view/zuanlan/13598

java.lang.IllegalStateException: UT000046: The number of cookies sent exceeded the maximum of 200

at io.undertow.util.Cookies.createCookie(Cookies.java:346)

at io.undertow.util.Cookies.parseCookie(Cookies.java:315)

at io.undertow.util.Cookies.parseRequestCookies(Cookies.java:216)

at io.undertow.util.Cookies.parseRequestCookies(Cookies.java:206)

at io.undertow.util.Cookies.parseRequestCookies(Cookies.java:202)

at io.undertow.server.HttpServerExchange.getRequestCookies(HttpServerExchange.java:1128)

at io.undertow.server.session.SessionCookieConfig.findSessionId(SessionCookieConfig.java:84)

at io.undertow.servlet.spec.SessionCookieConfigImpl.findSessionId(SessionCookieConfigImpl.java:61)

at io.undertow.servlet.spec.ServletContextImpl$ServletContextSessionConfig.findSessionId(ServletContextImpl.java:1225)

at io.undertow.server.session.InMemorySessionManager.getSession(InMemorySessionManager.java:215)

at io.undertow.servlet.spec.ServletContextImpl.getSession(ServletContextImpl.java:858)

at io.undertow.servlet.spec.ServletContextImpl.getSession(ServletContextImpl.java:938)

at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:69)

at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)

at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:269)

at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:78)

at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:133)

at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:130)

at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)

at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)

at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:249)

at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:78)

at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:99)

at io.undertow.server.Connectors.executeRootHandler(Connectors.java:376)

at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

at java.lang.Thread.run(Thread.java:748)

自己仔细的测试和源码检查，发现站点本身用的cookie数量非常少。

我反复百度了，只找到一个可能有用的线索，如下：
再次重新审视这一点，我发现，它似乎是一种确定的安全措施。

起初我认为，在特定的时间范围内，只能生成有限数量的cookie，但情况并非如此。如果攻击者试图通过向请求发送大量cookie来攻击您的Web服务器，则会抛出此异常，可能导致缓冲区溢出。

针对这个问题，我查了很多资料，最终觉得还是cookie攻击，解决方法只有通过nginx 防火墙了。在此记录一下，期待以后有人提供更好的方法。
我写的防火墙代码如下：

local ck_list=split2(request_header['cookie'],';')
if ck_list and #ck_list>200 then
	write_log('cookie','数量超过200')
	return true
end