{"record":{"id":"868665b9e090f7b3","repo":"apereo/cas","slug":"no-username-parameter-is-provided","errorCode":null,"errorMessage":"No username parameter is provided","messagePattern":"No username parameter is provided","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/SendPasswordResetInstructionsAction.java","lineNumber":249,"sourceCode":"    protected @Nullable MultifactorAuthenticationProvider selectMultifactorAuthenticationProvider(\n        final RequestContext requestContext,\n        final Principal principal) throws Throwable {\n        val applicationContext = requestContext.getActiveFlow().getApplicationContext();\n        val providers = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(applicationContext);\n        val registeredService = WebUtils.getRegisteredService(requestContext);\n        return multifactorAuthenticationProviderSelector.resolve(providers.values(), registeredService, principal);\n    }\n\n    protected PasswordManagementQuery buildPasswordManagementQuery(final RequestContext requestContext) {\n        val existingQuery = WebUtils.getPasswordManagementQuery(requestContext, PasswordManagementQuery.class);\n        return Optional.ofNullable(existingQuery)\n            .orElseGet(() -> {\n                val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);\n                val username = request.getParameter(REQUEST_PARAMETER_USERNAME);\n\n                val builder = PasswordManagementQuery.builder();\n                if (StringUtils.isBlank(username)) {\n                    LOGGER.warn(\"No username parameter is provided\");\n                }\n                return builder.username(username).build();\n            });\n    }\n\n    protected Event getInvalidContactEvent(final RequestContext requestContext) {\n        return getErrorEvent(\"contact.invalid\", \"Provided email address or phone number is invalid\", requestContext);\n    }\n\n    protected boolean sendPasswordResetSmsToAccount(final RequestContext requestContext,\n                                                    final List<String> recipients, final URL url) throws Throwable {\n        if (!recipients.isEmpty()) {\n            LOGGER.debug(\"Sending password reset URL [{}] via SMS to [{}]\", url.toExternalForm(), recipients);\n            val reset = casProperties.getAuthn().getPm().getReset().getSms();\n            val message = SmsBodyBuilder.builder().properties(reset).parameters(Map.of(\"url\",\n                url.toExternalForm())).build().get();\n            val smsRequest = SmsRequest.builder()\n                .from(reset.getFrom())","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/SendPasswordResetInstructionsAction.java#L231-L267","documentation":"CAS password management logs this warning when the password-reset instructions flow cannot find a 'username' request parameter, so the PasswordManagementQuery is built with a blank username. The subsequent reset-instruction submission cannot identify which account to email, so the flow will fail or return an invalid-contact event.","triggerScenarios":"A user (or automation) POSTs to the password reset instructions endpoint without the required 'username' form/HTTP parameter, i.e. WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext).getParameter(\"username\") returns null or blank.","commonSituations":"Custom reset pages that omit the username field; direct URL access to the forgot-password flow without query params; bots hitting the endpoint; renamed parameter in a custom front-end after a CAS upgrade.","solutions":["Add a required, non-empty 'username' input field to the password-reset form and submit it with the request.","Verify the form field's name attribute is exactly 'username' and that the request method carries it (form-encoded POST or query string).","If the caller is a script/integration, include ?username=<value> in the request to the password management endpoint.","Ensure any proxy/gateway is not stripping form parameters on POST bodies."],"exampleFix":"// before\ncurl -X POST https://cas.example.org/cas/pm/webflow?execution=... -d ''\n// after\ncurl -X POST 'https://cas.example.org/cas/pm/webflow?execution=...' -d 'username=jdoe'","handlingStrategy":"validation","validationCode":"const username = params.get('username');\nif (!username || username.trim() === '') {\n  throw new Error('username parameter is required for password reset');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make the username field required in the reset form with client-side validation","Add an integration test asserting the reset endpoint rejects requests without username"],"tags":["password-management","missing-parameter","webflow"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}