{"record":{"id":"6a4b0ebf9ceaf050","repo":"apereo/cas","slug":"unable-to-match-required-address-ip-because-clie","errorCode":null,"errorMessage":"Unable to match required address <ip> because client ip at time of cookie creation is unknown for cookie <name>","messagePattern":"Unable to match required address <ip> because client ip at time of cookie creation is unknown for cookie <name>","errorType":"exception","errorClass":"InvalidCookieException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java","lineNumber":119,"sourceCode":"            return cookieValue;\n        }\n\n        if (cookieParts.size() != COOKIE_FIELDS_LENGTH) {\n            throw new InvalidCookieException(\"Invalid cookie %s. Required fields are missing\".formatted(cookieProperties.getName()));\n        }\n        val cookieClientLocationOrIp = cookieParts.get(1);\n        val cookieUserAgent = cookieParts.get(2);\n\n        if (Stream.of(cookieValue, cookieClientLocationOrIp, cookieUserAgent).anyMatch(StringUtils::isBlank)) {\n            throw new InvalidCookieException(\"Invalid cookie %s. Required fields are empty\".formatted(cookieProperties.getName()));\n        }\n\n        val clientInfo = ClientInfoHolder.getClientInfo();\n        if (clientInfo == null) {\n            val message = \"Unable to match required remote address %s because client ip at time of cookie creation is unknown for cookie %s\"\n                .formatted(cookieProperties.getName(), cookieClientLocationOrIp);\n            LOGGER.warn(message);\n            throw new InvalidCookieException(message);\n        }\n\n        if (cookieProperties.isGeoLocateClientSession()) {\n            val clientLocationOrIp = getClientGeoLocation(clientInfo);\n            if (!cookieClientLocationOrIp.equals(clientLocationOrIp)) {\n                val message = \"Invalid cookie %s Required remote address %s does not match %s\"\n                    .formatted(cookieProperties.getName(), cookieClientLocationOrIp, clientLocationOrIp);\n                LOGGER.warn(message);\n                throw new InvalidCookieException(message);\n            }\n        } else {\n            val clientIpAddress = clientInfo.getClientIpAddress();\n            if (!cookieClientLocationOrIp.equals(clientIpAddress)) {\n                if (StringUtils.isBlank(cookieProperties.getAllowedIpAddressesPattern())\n                    || !RegexUtils.find(cookieProperties.getAllowedIpAddressesPattern(), clientIpAddress)) {\n                    val message = \"Invalid cookie %s. Required remote address %s does not match %s\"\n                        .formatted(cookieProperties.getName(), cookieClientLocationOrIp, clientIpAddress);\n                    LOGGER.warn(message);","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java#L101-L137","documentation":"The cookie was pinned to the client's IP (or geo-location) at creation time, but ClientInfoHolder.getClientInfo() returned null for the current request, so there is no client IP to compare against the address stored in the cookie. Session-pinning validation cannot proceed, and the cookie is rejected rather than trusted blindly — a defensive check against replay from an unverifiable context.","triggerScenarios":"Thrown at core/cas-server-core-cookie-api/src/main/java/org/apereo/cas/web/support/mgmr/DefaultCasCookieValueManager.java:119 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the request flows through the CAS webflow/servlet pipeline so ClientInfoHolder is populated","Check that any filter which sets ClientInfo (e.g., ClientInfoThreadLocalFilter) runs before cookie validation","If session pinning cannot be supported for this path, disable pinToSession for the cookie"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}