{"record":{"id":"1608a1cadfdead83","repo":"passbolt/passbolt_api","slug":"ajax-json-request-not-supported-handleerrorcontroller","errorCode":null,"errorMessage":"Ajax/Json request not supported.","messagePattern":"Ajax/Json request not supported\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/SelfRegistration/HandleErrorController.php","lineNumber":43,"sourceCode":"class HandleErrorController extends AbstractSsoController\n{\n    /**\n     * @inheritDoc\n     */\n    public function beforeFilter(EventInterface $event)\n    {\n        parent::beforeFilter($event);\n\n        $this->Authentication->allowUnauthenticated(['handleError']);\n    }\n\n    /**\n     * @return void\n     */\n    public function handleError(): void\n    {\n        if ($this->request->is('json')) {\n            throw new BadRequestException(__('Ajax/Json request not supported.'));\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $email = $this->request->getQuery('email');\n        if (!is_string($email) || !EmailValidationRule::check($email)) {\n            throw new BadRequestException(__('The email is required in URL parameters.'));\n        }\n\n        $this->set(['message' => __('The user does not exist.')]);\n\n        $this\n            ->viewBuilder()\n            ->setLayout('default')\n            ->setTemplatePath('SelfRegistration')\n            ->setTemplate('handle_error');\n    }\n}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/SelfRegistration/HandleErrorController.php#L25-L61","documentation":"Thrown by HandleErrorController::handleError when the request is JSON/Ajax. This controller renders a user-facing HTML error page for failed SSO self-registration flows, so JSON requests are rejected with 400, mirroring the other success/error redirect endpoints.","triggerScenarios":"Requesting the self-registration error-handling endpoint via fetch/XHR, curl with Accept: application/json, or any JSON-marked request instead of browser navigation.","commonSituations":"Frontend code intercepts the error redirect and performs it via XHR; developer tests the error page URL with JSON headers; monitoring bots request the endpoint with JSON Accept headers.","solutions":["Navigate to the error URL with a normal browser redirect (HTML), not via fetch/XHR","Drop JSON Accept/Content-Type headers when testing with curl/Postman","Handle the underlying self-registration error in the JSON API flow before redirecting to this page","Return the browser directly to the URL the server produced (e.g. after failed SSO register callback)"],"exampleFix":"// before\nfetch('/sso/self-registration/error?email=...') // JSON-marked XHR\n// after\nwindow.location.href = '/sso/self-registration/error?email=...'","handlingStrategy":"validation","validationCode":"const isJsonRequest = (init) =>\n  (init?.headers?.Accept || '').includes('application/json') ||\n  (init?.headers?.['Content-Type'] || '').includes('application/json');\nif (isJsonRequest(myInit)) throw new Error('Error page must be loaded via browser navigation.');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Redirect the browser to the error page URL instead of fetching it","Exclude error-page routes from JSON-forcing request interceptors","Test error paths with full page navigation","Handle registration errors in the JSON flow before the HTML redirect"],"tags":["sso","http","content-negotiation","self-registration"],"backgroundTag":"operation-not-supported","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}