{"record":{"id":"9178d6d056e4d962","repo":"passbolt/passbolt_api","slug":"the-authentication-token-must-be-a-valid-uuid","errorCode":null,"errorMessage":"The authentication token must be a valid UUID.","messagePattern":"The authentication token must be a valid UUID\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php","lineNumber":106,"sourceCode":"            return;\n        }\n\n        $userId = $this->getRequest()->getQuery('user_id');\n        $authToken = $this->getRequest()->getQuery('token');\n\n        if (is_null($userId) || is_null($authToken)) {\n            throw new UnauthorizedException(\n                __('You are not authorized to access this location.') . ' ' .\n                __('Sign-in to passbolt, or provide a valid user ID and authentication token.')\n            );\n        }\n\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user ID must be a valid UUID.'));\n        }\n\n        if (!Validation::uuid($authToken)) {\n            throw new BadRequestException(__('The authentication token must be a valid UUID.'));\n        }\n\n        $errorMsg = __('Unable to authenticate the guest user with the provided credentials.');\n\n        try {\n            (new AuthenticationTokenGetService())\n                ->getActiveNotExpiredOrFail($authToken, $userId, AuthenticationToken::TYPE_REGISTER);\n        } catch (NotFoundException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('No registration authentication token found for the given user.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (CustomValidationException $exception) {\n            $errorMsg .= ' ';\n            $errorMsg .= __('The registration authentication token is expired.');\n            throw new BadRequestException($errorMsg, null, $exception);\n        } catch (Exception $exception) {\n            throw new ForbiddenException($errorMsg, null, $exception); // phpcs:ignore\n        }","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php#L88-L124","documentation":"A BadRequestException thrown when the token query parameter fails UUID validation. Like the user_id check, the authentication token must be a valid UUID before AuthenticationTokenGetService performs the lookup.","triggerScenarios":"Unauthenticated GET /user-key-policies/settings?user_id=<uuid>&token=<not-a-uuid>, e.g. token passed as a verification token string, JWT, or malformed/truncated value.","commonSituations":"Sending the wrong token type (e.g. a GPG verify token or JWT instead of the passbolt authentication token UUID); truncated copy-paste; using a token generated by a different endpoint with a non-UUID format.","solutions":["Provide the correct authentication token UUID issued by passbolt's token endpoints.","Check which token type the client fetched — this endpoint expects a UUID-format authentication token, not a JWT or secret string.","Ensure the token is not truncated or altered by URL processing."],"exampleFix":"// before\n?user_id=0d2f...&token=abc123   // not a UUID\n// after\n?user_id=0d2f...&token=9a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(params.token)) throw new Error('token must be a valid UUID authentication token');","typeGuard":"const isUuidToken = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);","tryCatchPattern":"catch (e) {\n  if (e.response?.status === 400 && /token must be a valid UUID/.test(e.response.data?.message)) {\n    // fetch the correct authentication token UUID from the token endpoint\n  }\n}","preventionTips":["Store and pass the token exactly as issued (UUID format).","Distinguish authentication-token UUIDs from JWTs or secrets in client config.","Validate token format client-side before each request."],"tags":["bad-request","validation","uuid","authentication-token"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}