{"record":{"id":"674dfc4ea4921ee6","repo":"passbolt/passbolt_api","slug":"the-authentication-token-should-be-a-valid-uuid-674dfc","errorCode":null,"errorMessage":"The authentication token should be a valid UUID.","messagePattern":"The authentication token should be a valid UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php","lineNumber":64,"sourceCode":"     * Constructor\n     */\n    public function __construct()\n    {\n        $this->SsoAuthenticationTokens = $this->fetchTable('Passbolt/Sso.SsoAuthenticationTokens');\n    }\n\n    /**\n     * @param string $token token\n     * @param string $type type\n     * @param string|null $userId uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the authentication token is invalid\n     * @throws \\Cake\\Datasource\\Exception\\RecordNotFoundException if the authentication token cannot be found\n     * @return \\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken\n     */\n    public function getOrFail(string $token, string $type, ?string $userId = null): SsoAuthenticationToken\n    {\n        if (!Validation::uuid($token)) {\n            throw new BadRequestException(__('The authentication token should be a valid UUID.'));\n        }\n        if (isset($userId) && !Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id should be a valid UUID.'));\n        }\n\n        try {\n            $where = [\n                'token' => $token,\n                'type' => $type,\n                'active' => true,\n            ];\n            if (isset($userId)) {\n                $where['user_id'] = $userId;\n            }\n\n            /** @var \\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken $tokenEntity */\n            $tokenEntity = $this->SsoAuthenticationTokens->find()->where($where)->firstOrFail();\n        } catch (RecordNotFoundException $exception) {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php#L46-L82","documentation":"SsoAuthenticationTokenGetService::getOrFail validates that the provided SSO authentication token string is a UUID before querying the sso_authentication_tokens table. Non-UUID tokens are rejected immediately with a 400 BadRequestException instead of a record lookup.","triggerScenarios":"Passing a malformed token (truncated string, base64/JWT-like value, empty string, or non-token identifier) to getOrFail, or to its callers getActiveNotExpiredOrFail/get/activate when handling an SSO callback whose token parameter was corrupted or misconstructed.","commonSituations":"Client-side URL mangling truncating the token in the SSO redirect; passing an SSO session id instead of the authentication token; older client version building the verify URL incorrectly; copy/paste dropping characters; token generated by a different mechanism.","solutions":["Regenerate the SSO authentication token server-side (SsoAuthenticationTokenCreateService) and restart the flow with the fresh token","Inspect the incoming token value in the request/URL; ensure it is a full UUID v4 string","Check client code that constructs the SSO verify URL for truncation/encoding bugs (e.g. missing urlencode or string split)","Ensure callers pass the sso_authentication_tokens id, not a session id or nonce"],"exampleFix":"// before\n$token = $session->read('sso_token');\n$ssoToken = $service->getOrFail($token, SsoAuthenticationToken::TYPE_SSO);\n\n// after\n$token = $session->read('sso_token');\nif ($token === null || !Validation::uuid($token)) {\n    throw new BadRequestException(__('Missing or malformed SSO token.'));\n}\n$ssoToken = $service->getOrFail($token, SsoAuthenticationToken::TYPE_SSO);","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif (!Validation::uuid($token)) {\n    throw new BadRequestException(__('The authentication token should be a valid UUID.'));\n}\nif (isset($userId) && !Validation::uuid($userId)) {\n    throw new BadRequestException(__('The user id should be a valid UUID.'));\n}","typeGuard":"function isUuid(?string $value): bool\n{\n    return $value !== null && \\Cake\\Validation\\Validation::uuid($value);\n}","tryCatchPattern":"try {\n    $token = $service->getOrFail($token, SsoAuthenticationToken::TYPE_SSO, $userId);\n} catch (BadRequestException $e) {\n    // token/userId not a UUID: restart the SSO flow with a fresh token\n} catch (RecordNotFoundException $e) {\n    // token well-formed but unknown/expired\n}","preventionTips":["Validate the token with Validation::uuid() before calling any SSO token service","Ensure clients urlencode the token when building SSO verify URLs","Pass the sso_authentication_tokens UUID, not a session id or nonce","Regenerate tokens rather than reusing tokens from failed flows"],"tags":["sso","authentication-token","uuid","validation"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}