{"record":{"id":"813f0cf2f67545f7","repo":"TechnitiumSoftware/DnsServer","slug":"token-name-length-cannot-exceed-255-characters","errorCode":null,"errorMessage":"Token name length cannot exceed 255 characters.","messagePattern":"Token name length cannot exceed 255 characters\\.","errorType":"validation","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/UserSession.cs","lineNumber":58,"sourceCode":"    {\n        #region variables\n\n        readonly string _token;\n        UserSessionType _type;\n        readonly string _tokenName;\n        User _user;\n        DateTime _lastSeen;\n        IPAddress _lastSeenRemoteAddress;\n        string _lastSeenUserAgent;\n\n        #endregion\n\n        #region constructor\n\n        public UserSession(UserSessionType type, string tokenName, User user, IPAddress remoteAddress, string lastSeenUserAgent)\n        {\n            if ((tokenName is not null) && (tokenName.Length > 255))\n                throw new ArgumentOutOfRangeException(nameof(tokenName), \"Token name length cannot exceed 255 characters.\");\n\n            if (remoteAddress.IsIPv4MappedToIPv6)\n                remoteAddress = remoteAddress.MapToIPv4();\n\n            Span<byte> tokenBytes = stackalloc byte[32];\n            RandomNumberGenerator.Fill(tokenBytes);\n            _token = Convert.ToHexString(tokenBytes).ToLowerInvariant();\n\n            _type = type;\n            _tokenName = tokenName;\n            _user = user;\n            _lastSeen = DateTime.UtcNow;\n            _lastSeenRemoteAddress = remoteAddress;\n            _lastSeenUserAgent = lastSeenUserAgent;\n\n            if ((_lastSeenUserAgent is not null) && (_lastSeenUserAgent.Length > 255))\n                _lastSeenUserAgent = _lastSeenUserAgent.Substring(0, 255);\n        }","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/UserSession.cs#L40-L76","documentation":"Thrown by the UserSession constructor when tokenName is non-null and longer than 255 characters. Like DisplayName, the token name is persisted with WriteShortString so a longer value would break serialization of the session store. Null is permitted (anonymous/session token). ArgumentOutOfRangeException indicates the constructor argument itself is bad; nothing is allocated.","triggerScenarios":"Constructing a new UserSession(type, tokenName, ...) with a descriptive token name longer than 255 chars, e.g. an auto-generated name that concatenates many fields, or a user-supplied label with no client-side cap.","commonSituations":"API-token creation form with no maxlength; a naming template that embeds a long description or URL; automation that names tokens after a full request context.","solutions":["Enforce a 255-character client-side and server-side limit on the token name field.","Truncate auto-generated names before passing them to the constructor.","Validate tokenName?.Length <= 255 in the API handler and return a 400 before reaching the constructor."],"exampleFix":"// before\nvar session = new UserSession(type, tokenName, user, addr, ua);\n\n// after\nif (tokenName?.Length > 255)\n    throw new ArgumentException(\"Token name must be 255 characters or fewer.\");\nvar session = new UserSession(type, tokenName, user, addr, ua);","handlingStrategy":"validation","validationCode":"const int MAX = 255;\nif (tokenName is not null && tokenName.Length > MAX)\n    return BadRequest($\"Token name cannot exceed {MAX} characters.\");\nvar session = new UserSession(type, tokenName, user, addr, ua);","typeGuard":"static bool IsValidTokenName(string name) => name is null || name.Length <= 255;","tryCatchPattern":null,"preventionTips":["Cap token-name inputs at 255 characters in the UI and API.","Truncate auto-generated token names before construction.","Return a 400 from the API before reaching the constructor."],"tags":["auth","session","token","validation","length-limit","technitium-dns-server"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}