{"record":{"id":"3bfef24bd1b87d23","repo":"neo4j/neo4j","slug":"authentication-tokens-should-not-contain-points","errorCode":null,"errorMessage":"Authentication tokens should not contain points","messagePattern":"Authentication tokens should not contain points","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"community/bolt/src/main/java/org/neo4j/bolt/protocol/common/message/decoder/util/AuthenticationMetadataUtils.java","lineNumber":123,"sourceCode":"\n        @Override\n        protected Node newNodeEntityByElementId(String elementId) {\n            throw new UnsupportedOperationException(\"Authentication tokens should not contain nodes\");\n        }\n\n        @Override\n        protected Relationship newRelationshipEntityById(long id) {\n            throw new UnsupportedOperationException(\"Authentication tokens should not contain relationships\");\n        }\n\n        @Override\n        protected Relationship newRelationshipEntityByElementId(String elementId) {\n            throw new UnsupportedOperationException(\"Authentication tokens should not contain relationships\");\n        }\n\n        @Override\n        protected Point newPoint(CoordinateReferenceSystem crs, double[] coordinate) {\n            throw new UnsupportedOperationException(\"Authentication tokens should not contain points\");\n        }\n    }\n}\n","sourceCodeStart":105,"sourceCodeEnd":127,"githubUrl":"https://github.com/neo4j/neo4j/blob/f213380f812b820a1b312e2ea52cb3d8f1931ccc/community/bolt/src/main/java/org/neo4j/bolt/protocol/common/message/decoder/util/AuthenticationMetadataUtils.java#L105-L127","documentation":"The point-value guard in auth tokens: AuthTokenValueWriter.newPoint throws UnsupportedOperationException when the HELLO auth token contains a spatial Point value. Unlike the transaction-metadata writer (which supports points), the auth-token writer rejects them too, because auth metadata must flatten to plain Java objects that the security backends can store/compare. Thrown during HELLO decoding, before authentication proceeds.","triggerScenarios":"An authToken map in HELLO contains a Bolt Point struct (e.g. a location value from a previous query result reused in the token), so flattening dispatches to the guarded newPoint instead of Values.pointValue.","commonSituations":"Apps storing 'last known location' points and attaching them to auth tokens; Custom clients reusing arbitrary result values as token extras; Test harnesses fuzzing token maps with all value types","solutions":["Convert the Point to a primitive form before adding it to the token: {lat: p.y, lon: p.x} or a WKT string","Keep auth tokens limited to scheme/principal/credentials/realm and scalar extras","Assert token values are String/Number/Boolean before connecting"],"exampleFix":"// before\n{ scheme:'basic', ..., home: pointValue }\n\n// after\n{ scheme:'basic', ..., homeLat: pointValue.y, homeLon: pointValue.x }","handlingStrategy":"validation","validationCode":"const flat = { lat: p.y, lon: p.x, srid: p.srid };","typeGuard":"function isPoint(v) { return v && typeof v === 'object' && 'srid' in v; }","tryCatchPattern":"catch (e) { if (/tokens should not contain points/i.test(e.message)) { serialize point as lat/lon numbers and reconnect; } else throw e; }","preventionTips":["Remember auth tokens are stricter than tx_metadata: points allowed in one, rejected in the other"],"tags":["bolt","authentication","spatial"],"backgroundTag":null,"analyzedSha":"f213380f812b820a1b312e2ea52cb3d8f1931ccc","analyzedAt":"2026-08-14T15:32:33.859Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}