{"record":{"id":"5df8137ccb6f6762","repo":"passbolt/passbolt_api","slug":"the-email-is-required-in-url-parameters","errorCode":null,"errorMessage":"The email is required in URL parameters.","messagePattern":"The email is required in URL parameters\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/SelfRegistration/HandleErrorController.php","lineNumber":50,"sourceCode":"        parent::beforeFilter($event);\n\n        $this->Authentication->allowUnauthenticated(['handleError']);\n    }\n\n    /**\n     * @return void\n     */\n    public function handleError(): void\n    {\n        if ($this->request->is('json')) {\n            throw new BadRequestException(__('Ajax/Json request not supported.'));\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $email = $this->request->getQuery('email');\n        if (!is_string($email) || !EmailValidationRule::check($email)) {\n            throw new BadRequestException(__('The email is required in URL parameters.'));\n        }\n\n        $this->set(['message' => __('The user does not exist.')]);\n\n        $this\n            ->viewBuilder()\n            ->setLayout('default')\n            ->setTemplatePath('SelfRegistration')\n            ->setTemplate('handle_error');\n    }\n}\n","sourceCodeStart":32,"sourceCodeEnd":62,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/SelfRegistration/HandleErrorController.php#L32-L62","documentation":"Thrown by the SSO recover error-handling controller when the 'email' query parameter is absent, not a string, or fails email format validation. Passbolt requires the URL to identify the recovering account via a valid email so it can render the appropriate error screen.","triggerScenarios":"Hitting GET /sso-recover/error (or similar) without ?email=, with an empty email=, or with a malformed value like email=not-an-email.","commonSituations":"Users/bookmarks saved with a truncated SSO recover URL; custom identity-provider redirect templates omitting the email query parameter; proxies rewriting or stripping the query string; users typing the error URL manually.","solutions":["Append a syntactically valid email query parameter to the URL, e.g. ?email=user%40example.com","Check the SSO/IdP redirect template that builds the recover URL and include the email parameter URL-encoded","Verify no reverse proxy or rewrite rule strips query parameters","If the email is genuinely unknown, start the recover flow again from the login/recover page"],"exampleFix":"// before\nGET /sso/recover/error?email=\n// after\nGET /sso/recover/error?email=user%40example.com","handlingStrategy":"validation","validationCode":"const email = new URLSearchParams(window.location.search).get('email');\nif (typeof email === 'string' && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n  window.location.href = '/sso/recover/error?email=' + encodeURIComponent(email);\n}","typeGuard":"function isNonEmptyEmail(v) { return typeof v === 'string' && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(v); }","tryCatchPattern":null,"preventionTips":["Always build SSO recover URLs with encodeURIComponent(email)","Include the email parameter in IdP redirect templates","Never hand-strip query parameters from passbolt links"],"tags":["http","bad-request","query-parameter","email-validation","sso"],"backgroundTag":"invalid-query-parameter","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}