{"record":{"id":"9589acbeb4a225c6","repo":"Pumpkin-MC/Pumpkin","slug":"could-not-parse-uuid-from-validated-token","errorCode":null,"errorMessage":"Could not parse UUID from validated token","messagePattern":"Could not parse UUID from validated token","errorType":"error_code","errorClass":"LoginError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin/src/net/bedrock/login/mod.rs","lineNumber":38,"sourceCode":"};\nuse pumpkin_util::version::BedrockMinecraftVersion;\nuse pumpkin_world::{CURRENT_BEDROCK_MC_PROTOCOL, CURRENT_BEDROCK_MC_VERSION};\nuse serde::{Deserialize, de::Error};\nuse serde_repr::Deserialize_repr;\nuse std::sync::Arc;\nuse thiserror::Error;\nuse tracing::debug;\nuse uuid::Uuid;\n\n#[derive(Debug, Error)]\npub enum LoginError {\n    #[error(\"Login packet data is not valid JSON\")]\n    InvalidTokenFormat(#[from] serde_json::Error),\n    #[error(\"JWT chain validation failed: {0}\")]\n    ChainValidationFailed(#[from] AuthError),\n    #[error(\"The validated username is invalid\")]\n    InvalidUsername,\n    #[error(\"Could not parse UUID from validated token\")]\n    InvalidUuid,\n    #[error(\"Cannot accept self-signed token. Authentication is enforced by server config.\")]\n    SelfSignedNotAllowed,\n    #[error(\"Got a guest/splitscreen login request. Currently unimplemented.\")]\n    GuestUnimplemented,\n    #[error(\"Failed to decode extra using decode_b64_url_nopad.\")]\n    DecodeExtraError,\n}\n\n#[derive(Deserialize_repr)]\n#[repr(u8)]\nenum AuthenticationType {\n    Full,\n    Guest,\n    SelfSigned,\n}\n\n#[derive(Deserialize)]","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin/src/net/bedrock/login/mod.rs#L20-L56","documentation":"This is the LoginError::InvalidUuid variant. Pumpkin parses the client's UUID from the validated identity token's claims after chain validation succeeds. The library throws this when that UUID field is absent or cannot be parsed, since every player needs a stable unique ID for entity tracking and storage.","triggerScenarios":"The validated JWT claims lack the expected identity/UUID field, or the field holds a string that is not a valid UUID (e.g. truncated text, base64 blobs, or an XUID where a UUID is expected).","commonSituations":"Custom or broken authentication proxies that rewrite token claims, modified clients omitting the identity claim, or testing harnesses that build tokens by hand with malformed UUID strings.","solutions":["Ensure the client obtains its token from the real Xbox Live/Mojang flow so the identity claim contains a valid UUID","If crafting test tokens, embed a canonical UUID string (e.g. 069a79f4-44e9-4726-a5be-fca90e38aaf5) in the claims","Check any auth proxy/middleware that it does not strip or reformat the UUID claim","Update the server if token claim layout changed in a newer Mojang auth version"],"exampleFix":"// before (hand-built test token)\njson!({ \"identity\": \"not-a-uuid\", \"displayName\": \"Steve\" })\n// after\njson!({ \"identity\": \"069a79f4-44e9-4726-a5be-fca90e38aaf5\", \"displayName\": \"Steve\" })","handlingStrategy":"validation","validationCode":"// Caller-side UUID claim check before login\nfn precheck_uuid(identity_claim: &str) -> Result<uuid::Uuid, String> {\n    uuid::Uuid::parse_str(identity_claim).map_err(|_| \"identity claim is not a valid UUID\".to_string())\n}","typeGuard":"fn is_invalid_uuid(e: &LoginError) -> bool {\n    matches!(e, LoginError::InvalidUuid)\n}","tryCatchPattern":"match login_result {\n    Err(LoginError::InvalidUuid) => {\n        error!(\"token claims missing/invalid identity UUID; check auth proxy or client\");\n        disconnect_with(\"Login token missing a valid player UUID\")\n    }\n    Err(e) => disconnect_with(&format!(\"Login failed: {e}\")),\n    Ok(p) => admit(p),\n}","preventionTips":["Obtain tokens through the real Xbox Live/Mojang flow, never hand-rolled claims","Canonicalize UUID strings (lowercase, hyphenated) in custom clients","Audit auth proxies for claim rewriting","Add a unit test that parses the UUID claim before sending"],"tags":["authentication","uuid","bedrock","minecraft","parsing"],"backgroundTag":"invalid-identifier-format","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}