apereo/cas · error · InvalidCookieException

Invalid cookie . Required fields are missing

Error message

Invalid cookie <name>. Required fields are missing

What it means

While reading a compound cookie, the split value did not contain the expected number of fields (cookieParts.size() != COOKIE_FIELDS_LENGTH), so required parts (value, client location/IP, user-agent) are missing. InvalidCookieException signals a malformed or truncated cookie — usually a stale cookie from an older format, manual tampering, or corruption in transit.

Solutions

1. Clear the browser cookie for the CAS domain and re-authenticate
2. Check whether the cookie format/field count changed across CAS upgrades and invalidate old cookies
3. Ensure no proxy or middleware truncates or rewrites the cookie value

When it happens

Trigger: Thrown at core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java:105 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/ff7bb476dfbe398b. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java:105

                return clientInfo.getClientIpAddress();
            })
            .filter(Objects::nonNull)
            .findFirst()
            .orElseGet(clientInfo::getClientIpAddress);
    }

    @Override
    protected String obtainValueFromCompoundCookie(final String value, final HttpServletRequest request) {
        val cookieParts = Splitter.on(String.valueOf(COOKIE_FIELD_SEPARATOR)).splitToList(value);

        val cookieValue = cookieParts.getFirst();
        if (!cookieProperties.isPinToSession()) {
            LOGGER.trace("Cookie session-pinning is disabled for cookie [{}]. Returning cookie value as it was provided", cookieProperties.getName());
            return cookieValue;
        }

        if (cookieParts.size() != COOKIE_FIELDS_LENGTH) {
            throw new InvalidCookieException("Invalid cookie %s. Required fields are missing".formatted(cookieProperties.getName()));
        }
        val cookieClientLocationOrIp = cookieParts.get(1);
        val cookieUserAgent = cookieParts.get(2);

        if (Stream.of(cookieValue, cookieClientLocationOrIp, cookieUserAgent).anyMatch(StringUtils::isBlank)) {
            throw new InvalidCookieException("Invalid cookie %s. Required fields are empty".formatted(cookieProperties.getName()));
        }

        val clientInfo = ClientInfoHolder.getClientInfo();
        if (clientInfo == null) {
            val message = "Unable to match required remote address %s because client ip at time of cookie creation is unknown for cookie %s"
                .formatted(cookieProperties.getName(), cookieClientLocationOrIp);
            LOGGER.warn(message);
            throw new InvalidCookieException(message);
        }

        if (cookieProperties.isGeoLocateClientSession()) {
            val clientLocationOrIp = getClientGeoLocation(clientInfo);

View on GitHub (pinned to e7288fc434)