{"record":{"id":"1fd38698b631d5c1","repo":"passbolt/passbolt_api","slug":"exception-getmessage-invalid-cookie-name-e-g-the-cookie-name","errorCode":null,"errorMessage":"$exception->getMessage() (invalid cookie name, e.g. \"The cookie name ... contains invalid characters.\")","messagePattern":"\\$exception->getMessage\\(\\) \\(invalid cookie name, e\\.g\\. \"The cookie name \\.\\.\\. contains invalid characters\\.\"\\)","errorType":"http","errorClass":"Cake\\Http\\Exception\\BadRequestException","httpStatus":400,"severity":"warning","filePath":"src/Middleware/ValidCookieNameMiddleware.php","lineNumber":43,"sourceCode":"\nclass ValidCookieNameMiddleware implements MiddlewareInterface\n{\n    /**\n     * Throws a bad request if the version passed in the request is not supported.\n     *\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The request handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface A response.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the API version provided is deprecated\n     */\n    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface\n    {\n        try {\n            /** @var \\Cake\\Http\\ServerRequest $request */\n            $request->getCookieCollection();\n        } catch (InvalidArgumentException $exception) {\n            // Remap error to 400\n            throw new BadRequestException($exception->getMessage(), null, $exception);\n        }\n\n        return $handler->handle($request);\n    }\n}\n","sourceCodeStart":25,"sourceCodeEnd":49,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Middleware/ValidCookieNameMiddleware.php#L25-L49","documentation":"Passbolt's ValidCookieNameMiddleware eagerly parses the request cookie collection. PHP's cookie parser throws InvalidArgumentException when a cookie header contains an invalid name (e.g. spaces, brackets, illegal characters). The middleware catches it and remaps it to CakePHP's BadRequestException so the client gets a 400 instead of a 500.","triggerScenarios":"An HTTP request arrives with a Cookie header containing a cookie whose name contains invalid characters (spaces, commas, semicolons, brackets, non-ASCII), so $request->getCookieCollection() throws.","commonSituations":"Misbehaving clients, browser extensions, proxies, or hand-built HTTP requests sending malformed cookies; legacy systems emitting cookie names with unquoted special characters.","solutions":["Inspect the Cookie header of the failing request and remove or fix the cookie with the invalid name.","Fix or update the client/proxy/extension generating the malformed cookie.","If the cookie is set by your own frontend, ensure names use only ASCII letters, digits, and '-' '_' per RFC 6265.","As a last resort, strip invalid cookies in an earlier middleware before cookie parsing."],"exampleFix":"// before: malformed header\nCookie: my cookie=abc; other=1\n// after\nCookie: my_cookie=abc; other=1","handlingStrategy":"try-catch","validationCode":"// Client-side: sanitize cookie names before sending\nconst validName = (name) => /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name);\nif (!validName('my_cookie')) { console.error('invalid cookie name'); }","typeGuard":"function hasValidCookieNames(header) {\n  return header.split(';').every(c => {\n    const name = c.split('=')[0].trim();\n    return /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name);\n  });\n}","tryCatchPattern":"try { $request->getCookieCollection(); } catch (InvalidArgumentException $e) {\n  throw new BadRequestException('Request contains an invalid cookie.', null, $e);\n}","preventionTips":["Use only RFC 6265 compliant cookie names (ASCII token characters).","Audit proxies/extensions that rewrite Cookie headers.","Test clients against strict cookie parsing in CI.","Never set cookie names with spaces, brackets or non-ASCII characters."],"tags":["http","cookie","bad-request","middleware"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}