TechnitiumSoftware/DnsServer · error · ArgumentOutOfRangeException

Token name length cannot exceed 255 characters.

Error message

Token name length cannot exceed 255 characters.

What it means

Thrown by the UserSession constructor when tokenName is non-null and longer than 255 characters. Like DisplayName, the token name is persisted with WriteShortString so a longer value would break serialization of the session store. Null is permitted (anonymous/session token). ArgumentOutOfRangeException indicates the constructor argument itself is bad; nothing is allocated.

Source

Thrown at DnsServerCore/Auth/UserSession.cs:58

    {
        #region variables

        readonly string _token;
        UserSessionType _type;
        readonly string _tokenName;
        User _user;
        DateTime _lastSeen;
        IPAddress _lastSeenRemoteAddress;
        string _lastSeenUserAgent;

        #endregion

        #region constructor

        public UserSession(UserSessionType type, string tokenName, User user, IPAddress remoteAddress, string lastSeenUserAgent)
        {
            if ((tokenName is not null) && (tokenName.Length > 255))
                throw new ArgumentOutOfRangeException(nameof(tokenName), "Token name length cannot exceed 255 characters.");

            if (remoteAddress.IsIPv4MappedToIPv6)
                remoteAddress = remoteAddress.MapToIPv4();

            Span<byte> tokenBytes = stackalloc byte[32];
            RandomNumberGenerator.Fill(tokenBytes);
            _token = Convert.ToHexString(tokenBytes).ToLowerInvariant();

            _type = type;
            _tokenName = tokenName;
            _user = user;
            _lastSeen = DateTime.UtcNow;
            _lastSeenRemoteAddress = remoteAddress;
            _lastSeenUserAgent = lastSeenUserAgent;

            if ((_lastSeenUserAgent is not null) && (_lastSeenUserAgent.Length > 255))
                _lastSeenUserAgent = _lastSeenUserAgent.Substring(0, 255);
        }

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Enforce a 255-character client-side and server-side limit on the token name field.
2. Truncate auto-generated names before passing them to the constructor.
3. Validate tokenName?.Length <= 255 in the API handler and return a 400 before reaching the constructor.

Example fix

// before
var session = new UserSession(type, tokenName, user, addr, ua);

// after
if (tokenName?.Length > 255)
    throw new ArgumentException("Token name must be 255 characters or fewer.");
var session = new UserSession(type, tokenName, user, addr, ua);

const int MAX = 255;
if (tokenName is not null && tokenName.Length > MAX)
    return BadRequest($"Token name cannot exceed {MAX} characters.");
var session = new UserSession(type, tokenName, user, addr, ua);

static bool IsValidTokenName(string name) => name is null || name.Length <= 255;

When it happens

Trigger: Constructing a new UserSession(type, tokenName, ...) with a descriptive token name longer than 255 chars, e.g. an auto-generated name that concatenates many fields, or a user-supplied label with no client-side cap.

Common situations: API-token creation form with no maxlength; a naming template that embeds a long description or URL; automation that names tokens after a full request context.

Related errors

• Display name length cannot exceed 255 characters.
• Session timeout value must be between 0-604800 seconds.
• Group name length cannot exceed 255 characters.
• Username length cannot exceed 255 characters.
• Invalid time-based one-time password (TOTP) was attempted fo

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/813f0cf2f67545f7. Report an issue: GitHub.