{"record":{"id":"605eeb818cbd6fcc","repo":"apereo/cas","slug":"invalid-cookie-name-required-remote-address-co","errorCode":null,"errorMessage":"Invalid cookie <name>. Required remote address <cookieIp> does not match <clientIp>","messagePattern":"Invalid cookie <name>\\. Required remote address <cookieIp> does not match <clientIp>","errorType":"exception","errorClass":"InvalidCookieException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java","lineNumber":138,"sourceCode":"        }\n\n        if (cookieProperties.isGeoLocateClientSession()) {\n            val clientLocationOrIp = getClientGeoLocation(clientInfo);\n            if (!cookieClientLocationOrIp.equals(clientLocationOrIp)) {\n                val message = \"Invalid cookie %s Required remote address %s does not match %s\"\n                    .formatted(cookieProperties.getName(), cookieClientLocationOrIp, clientLocationOrIp);\n                LOGGER.warn(message);\n                throw new InvalidCookieException(message);\n            }\n        } else {\n            val clientIpAddress = clientInfo.getClientIpAddress();\n            if (!cookieClientLocationOrIp.equals(clientIpAddress)) {\n                if (StringUtils.isBlank(cookieProperties.getAllowedIpAddressesPattern())\n                    || !RegexUtils.find(cookieProperties.getAllowedIpAddressesPattern(), clientIpAddress)) {\n                    val message = \"Invalid cookie %s. Required remote address %s does not match %s\"\n                        .formatted(cookieProperties.getName(), cookieClientLocationOrIp, clientIpAddress);\n                    LOGGER.warn(message);\n                    throw new InvalidCookieException(message);\n                }\n                LOGGER.debug(\"Required remote address [{}] does not match [{}], but it's authorized to proceed\",\n                    cookieClientLocationOrIp, clientIpAddress);\n            }\n        }\n\n        val agent = HttpRequestUtils.getHttpServletRequestUserAgent(request);\n        if (!cookieUserAgent.equals(agent)) {\n            val message = \"Invalid cookie %s. Required user-agent %s does not match %s\"\n                .formatted(cookieProperties.getName(), cookieUserAgent, agent);\n            LOGGER.warn(message);\n            throw new InvalidCookieException(message);\n        }\n        return cookieValue;\n    }\n}\n","sourceCodeStart":120,"sourceCodeEnd":155,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java#L120-L155","documentation":"Session pinning by IP: the client IP stored in the cookie does not match the current request's client IP, and no allowedIpAddressesPattern on the cookie config authorizes the new address. The cookie is rejected as a possible cookie-theft/replay from a different machine or network (e.g., NAT/proxy change, mobile network switch).","triggerScenarios":"Thrown at core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java:138 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Clear the cookie and re-authenticate","If the client legitimately changes IPs (NAT pools, VPNs), configure cas.cookie...allowedIpAddressesPattern to allow them","Disable pinToSession for this cookie if IP stability cannot be guaranteed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}