CursorMark query returns 400 error due to unencoded special characters

Issue

When executing a paginated query against Fusion’s Solr API using the cursorMark parameter, an HTTP 400 error may be returned after several loops of pagination. This typically occurs when the cursorMark value includes special characters that are not URL-encoded, such as the plus symbol (+).

Example error response:

"msg": "Unable to parse 'cursorMark' after totem: value must either be '*' or the 'nextCursorMark' returned by a previous search..."
"code": 400

Diagnosis

This error commonly occurs when nextCursorMark values returned by a previous query are used directly in subsequent requests without URL encoding. Characters such as +, /, or = can be misinterpreted by the HTTP parser if not encoded.

The issue is usually seen in Fusion deployments using GET requests for Solr queries, particularly when the cursorMark contains base64-encoded or long values that include reserved URL characters.

Environment

Fusion 5.9.0 and later
Applies to Managed Fusion (Lucidworks-hosted) and self-hosted environments using Solr pagination with cursorMark.

Cause

The cursorMark parameter in Solr queries must be URL-safe. When the value includes special characters (e.g., +, /), and is used in a GET request without URL encoding, the Solr API may reject it as malformed, resulting in a 400 Bad Request error.

Resolution

Encode the cursorMark parameter before reusing it in a Solr query

Before inserting the cursorMark value into a new HTTP GET request, URL-encode it to ensure all special characters are safely transmitted.

Example

Incorrect usage (unencoded +):

cursorMark=AoE/+QFodHRwczovL2hlbHAuc3BsdW5rLmNvbS9...

Correct usage (encoded + as %2B):

cursorMark=AoE/%2BQFodHRwczovL2hlbHAuc3BsdW5rLmNvbS9...

Most programming languages provide a URL encoder for this purpose. Here’s an example using curl where the cursorMark is encoded:

curl --location 'https://<fusion-host>/api/solr/<collection-name>/select?q=*%3A*&start=0&rows=200&cursorMark=AoE/%2BQFodHRwczov...&fl=id&wt=json&sort=id%20asc' \
--header 'Authorization: Bearer <token>'

Tip

If scripting or looping through paginated results, always pass the nextCursorMark value through a URL encoder before inserting it into the next query.

For example, in Python:

import urllib.parse
encoded_cursor = urllib.parse.quote(nextCursorMark)

Or in JavaScript:

const encodedCursor = encodeURIComponent(nextCursorMark);