{"record":{"id":"0d14c89bbdd04ddb","repo":"passbolt/passbolt_api","slug":"could-not-create-mfa-verified-cookie-0d14c8","errorCode":null,"errorMessage":"Could not create MFA verified cookie.","messagePattern":"Could not create MFA verified cookie\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/Duo/DuoVerifyCallbackGetController.php","lineNumber":213,"sourceCode":"     * Add to the response the MFA verified cookie.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac User access control\n     * @param \\App\\Authenticator\\SessionIdentificationServiceInterface $sessionIdentificationService session ID service\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if it cannot create MFA cookie\n     */\n    private function addMfaVerifiedCookieToResponse(\n        UserAccessControl $uac,\n        SessionIdentificationServiceInterface $sessionIdentificationService\n    ): void {\n        try {\n            $cookie = (new MfaVerifiedCookieService())->createDuoMfaVerifiedCookie(\n                $uac,\n                $sessionIdentificationService,\n                $this->getRequest()\n            );\n        } catch (Throwable $e) {\n            throw new InternalErrorException('Could not create MFA verified cookie.', null, $e);\n        }\n\n        $this->setResponse($this->getResponse()->withCookie($cookie));\n    }\n\n    /**\n     * Redirect the user if the authentication token contains a redirect path.\n     *\n     * @param \\App\\Model\\Entity\\AuthenticationToken $authenticationToken The authentication token\n     * @return void\n     */\n    private function redirectIfDefinedInToken(AuthenticationToken $authenticationToken): void\n    {\n        $redirect = $authenticationToken->getDataValue('redirect');\n        if (!empty($redirect) && substr($redirect, 0, 1) === '/') { // redirect path must start with / (internal link)\n            $this->redirect($redirect);\n        }\n    }","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/Duo/DuoVerifyCallbackGetController.php#L195-L231","documentation":"Wraps any failure while generating the MFA verified cookie after a successful Duo 2FA callback. The Duo provider has verified the user, but building the signed MfaVerifiedCookie (via MfaVerifiedCookieService::createDuoMfaVerifiedCookie) threw, so the server escalates to a 500 InternalErrorException with the original exception attached as 'previous'.","triggerScenarios":"Any Throwable raised inside createDuoMfaVerifiedCookie during DuoVerifyCallbackGetController::get: invalid/incomplete UAC, Duo org settings missing or malformed, session identification failure, or request state (cookies/params) the cookie service cannot consume.","commonSituations":"Duo API not configured in org settings, expired or missing Duo session data, misconfigured security salt used for cookie signing, or an unrelated bug in the cookie service after a Duo login flow change.","solutions":["Inspect the previous exception in the error log for the root cause","Verify Duo organization settings (host, ikey, skey) are present and valid","Run a database/cache health check; refresh app state if session storage is failing","Ensure MfaVerifiedCookieService dependencies (session identification, request) are wired correctly"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const duoConfigured = orgSettings?.mfa?.providers?.duo != null;\nif (!duoConfigured) throw new Error('Duo org settings missing; skip MFA cookie flow');","typeGuard":null,"tryCatchPattern":"try { const cookie = createDuoMfaVerifiedCookie(uac, session, req); } catch (e) { logger.error('mfa cookie failed', { cause: e }); throw new InternalError('Could not create MFA verified cookie.', e); }","preventionTips":["Always log/log the previous exception chain to find root causes","Validate Duo org settings before starting the verify callback flow","Keep session storage (DB/cache) healthy with periodic refresh"],"tags":["mfa","duo","cookie","internal-error"],"backgroundTag":"internal-invariant-violation","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}