{"record":{"id":"73b6375cb9b9d97f","repo":"passbolt/passbolt_api","slug":"the-data-must-be-a-string","errorCode":null,"errorMessage":"The data must be a string.","messagePattern":"The data must be a string\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyCreateService.php","lineNumber":78,"sourceCode":"                __('Could not save the metadata session key, please try again later.'),\n                null,\n                $e\n            );\n        }\n\n        return $result;\n    }\n\n    /**\n     * Basic sanity check for the given data value.\n     *\n     * @param mixed $data Data to check.\n     * @return void\n     */\n    private function assertData(mixed $data): void\n    {\n        if (!is_string($data)) {\n            throw new BadRequestException(__('The data must be a string.'));\n        }\n    }\n}\n","sourceCodeStart":60,"sourceCodeEnd":82,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Metadata/src/Service/MetadataSessionKeyCreateService.php#L60-L82","documentation":"BadRequestException thrown by the private assertData helper when the `data` payload for a new metadata session key is not a PHP string. The service requires the encrypted session key material to arrive as a raw string before any further processing.","triggerScenarios":"POST to the metadata session keys endpoint with `data` as null, array, object, or integer — typically when the client sends the encrypted blob as structured JSON instead of a string.","commonSituations":"Client auto-parses the armored/encrypted payload into an object before sending; forgetting json_encode/stringify; API consumers experimenting with the endpoint passing unserialized values.","solutions":["Send `data` as a plain string containing the encrypted session key material.","If your payload is an object, serialize it (JSON.stringify / json_encode) before assigning it to `data`.","Add a client-side check that `typeof data === 'string'` before issuing the request."],"exampleFix":"// before\n{ \"data\": { \"key\": \"...\" } }\n// after\n{ \"data\": \"{\\\"key\\\": \\\"...\\\"}\" }","handlingStrategy":"type-guard","validationCode":"function assertStringData(payload) {\n  if (typeof payload.data !== 'string') throw new Error('data must be a string');\n}\n// PHP\nif (!is_string($data)) throw new \\InvalidArgumentException('data must be a string');","typeGuard":"function isString(v) { return typeof v === 'string'; }","tryCatchPattern":"catch (BadRequestException) { // 400\n  // serialize payload.data to a string and resend\n}","preventionTips":["Stringify structured payloads before sending","Keep the encrypted blob opaque end-to-end","Add contract tests asserting `data` is a string"],"tags":["bad-request","validation","session-key","php"],"backgroundTag":"invalid-argument-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}