{"record":{"id":"5940f529be3b452b","repo":"passbolt/passbolt_api","slug":"the-authentication-token-should-be-a-valid-uuid-5940f5","errorCode":null,"errorMessage":"The authentication token should be a valid UUID.","messagePattern":"The authentication token should be a valid UUID\\.","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Service/Duo/MfaDuoLoginService.php","lineNumber":80,"sourceCode":"    /**\n     * Login using Duo for the operator.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The user access control\n     * @param \\Passbolt\\MultiFactorAuthentication\\Model\\Dto\\MfaDuoCallbackDto $duoCallbackDto The Duo callback data\n     * @param string $token The authentication token.\n     * @return \\App\\Model\\Entity\\AuthenticationToken\n     * @throws \\InvalidArgumentException if the provided token is not a UUID\n     * @throws \\Cake\\Http\\Exception\\UnauthorizedException If no active Duo callback authentication can be found.\n     * @throws \\Cake\\Http\\Exception\\UnauthorizedException If the duo state cannot be verified.\n     * @throws \\Cake\\Http\\Exception\\UnauthorizedException If the Duo code cannot be verified.\n     */\n    public function login(\n        UserAccessControl $uac,\n        MfaDuoCallbackDto $duoCallbackDto,\n        string $token\n    ): AuthenticationToken {\n        if (!Validation::uuid($token)) {\n            throw new InvalidArgumentException('The authentication token should be a valid UUID.');\n        }\n        $authenticationTokenType = AuthenticationToken::TYPE_MFA_VERIFY;\n        $authenticationToken = (new MfaDuoCallbackAuthenticationTokenService())\n            ->consumeAndVerifyAuthenticationToken(\n                $uac,\n                $authenticationTokenType,\n                $token,\n                $duoCallbackDto->state\n            );\n        try {\n            (new MfaDuoVerifyDuoCodeService($authenticationTokenType, $this->duoClient))\n                ->verify($uac, $duoCallbackDto->duoCode);\n        } catch (Throwable $th) {\n            throw new BadRequestException(__('Unable to verify Duo authentication.'), null, $th);\n        }\n\n        return $authenticationToken;\n    }","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Service/Duo/MfaDuoLoginService.php#L62-L98","documentation":"MfaDuoLoginService::login() requires the mfa_verify authentication token id passed as $token to be a valid UUID. Validation::uuid() rejects anything else, and an InvalidArgumentException is thrown before the token is consumed.","triggerScenarios":"Calling login($uac, $duoCallbackDto, $token) where $token is empty, truncated, url-mangled, or any non-UUID string — commonly a malformed callback query parameter.","commonSituations":"User bookmarks/pastes a partially truncated callback URL; a reverse proxy or client code mangles the query string; a custom frontend passes a session id instead of the token UUID.","solutions":["Pass the full authentication token UUID generated during the Duo start flow (AuthenticationToken.id)","Validate with Validation::uuid($token) (or a regex) before calling login()","Check that the callback route/query parameter name matches what passbolt emits so the token is not truncated"],"exampleFix":"// before\n$service->login($uac, $dto, $this->request->getQuery('token'));\n// after\n$token = $this->request->getQuery('token') ?? '';\nif (!Validation::uuid($token)) { throw new BadRequestException('Missing mfa token'); }\n$service->login($uac, $dto, $token);","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif (!is_string($token) || !Validation::uuid($token)) { throw new \\InvalidArgumentException('token must be a UUID'); }","typeGuard":"function isUuid(mixed $v): bool { return is_string($v) && (bool)preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i', $v); }","tryCatchPattern":"try { $service->login($uac, $dto, $token); } catch (\\InvalidArgumentException $e) { /* return 400 invalid token */ }","preventionTips":["Carry the token UUID from start() through the callback without truncation","Validate UUIDs on ingestion of any user-supplied id"],"tags":["mfa","duo","uuid","validation"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}