{"record":{"id":"23b34cb52daa43c7","repo":"passbolt/passbolt_api","slug":"conflicting-authentication-parameters-provide-user-id-token","errorCode":null,"errorMessage":"Conflicting authentication parameters, provide user_id/token only when the user is not already signed in.","messagePattern":"Conflicting authentication parameters, provide user_id/token only when the user is not already signed in\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php","lineNumber":85,"sourceCode":"\n    /**\n     * This method verifies that a guest user can be authenticated with a valid user ID and authentication token.\n     *\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException If the user is a guest and neither a user ID nor an authentication token is provided.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If the provided user ID is not a valid UUID.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException If the provided authentication token is not a valid UUID.\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException If no valid authentication token is found.\n     */\n    private function assertQueryParameters(): void\n    {\n        $isLoggedIn = !$this->User->isGuest();\n        $isUserToken = $this->getRequest()->getQuery('user_id', false) || $this->getRequest()->getQuery('token', false);\n\n        if ($isLoggedIn) {\n            if ($isUserToken) {\n                // session confusion: If user is logged in but still authentication token is provided we consider it bad request.\n                throw new BadRequestException(__('Conflicting authentication parameters, provide user_id/token only when the user is not already signed in.')); // phpcs:ignore\n            }\n\n            return;\n        }\n\n        $userId = $this->getRequest()->getQuery('user_id');\n        $authToken = $this->getRequest()->getQuery('token');\n\n        if (is_null($userId) || is_null($authToken)) {\n            throw new UnauthorizedException(\n                __('You are not authorized to access this location.') . ' ' .\n                __('Sign-in to passbolt, or provide a valid user ID and authentication token.')\n            );\n        }\n\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user ID must be a valid UUID.'));\n        }","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php#L67-L103","documentation":"A BadRequestException thrown by assertQueryParameters() when the caller is already authenticated (session present) but the request also supplies user_id and/or token query parameters. The controller treats this session/token mix as ambiguous and refuses the request rather than guessing which identity applies.","triggerScenarios":"GET /user-key-policies/settings made with an authenticated session while still passing ?user_id=<uuid>&token=<uuid> query parameters, typically by client code that blindly appends guest credentials.","commonSituations":"Client SDK or script built for the guest flow reused inside an authenticated browser session; leftover query params in a template/link after sign-in; integration tests where a logged-in fixture also passes token params.","solutions":["Remove the user_id and token query parameters from the request when a session is already authenticated.","Ensure the client only builds guest-style URLs (with user_id/token) when not signed in.","Clear stale cookies or sign out if the session is unintended and the guest token flow is actually desired."],"exampleFix":"// before\nGET /user-key-policies/settings.json?user_id=0d2f...&token=9a1b...\n// after (when already signed in)\nGET /user-key-policies/settings.json","handlingStrategy":"validation","validationCode":"const isSignedIn = Boolean(sessionCookie);\nconst hasGuestParams = url.searchParams.has('user_id') || url.searchParams.has('token');\nif (isSignedIn && hasGuestParams) {\n  url.searchParams.delete('user_id');\n  url.searchParams.delete('token');\n}","typeGuard":null,"tryCatchPattern":"catch (e) {\n  if (e.response?.status === 400 && /Conflicting authentication parameters/.test(e.response.data?.message)) {\n    // strip user_id/token params and retry\n  }\n}","preventionTips":["Build guest URLs only when no session exists.","Centralize request-URL construction to avoid leaking auth params.","Clear guest credentials after sign-in in client state."],"tags":["bad-request","authentication","query-parameters","session"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}