{"record":{"id":"affb2d5117c4f98f","repo":"apereo/cas","slug":"unable-to-accept-cookie-for-authentication","errorCode":null,"errorMessage":"Unable to accept cookie for authentication","messagePattern":"Unable to accept cookie for authentication","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-generic-remote-webflow/src/main/java/org/apereo/cas/adaptors/generic/remote/RemoteCookieAuthenticationHandler.java","lineNumber":54,"sourceCode":"        return credential instanceof RemoteAuthenticationCredential;\n    }\n\n    @Override\n    public boolean supports(final Class<? extends Credential> clazz) {\n        return RemoteAuthenticationCredential.class.isAssignableFrom(clazz);\n    }\n\n    @Override\n    public AuthenticationHandlerExecutionResult authenticate(final Credential credential, final Service service) throws Throwable {\n        try {\n            val addressCredential = (RemoteAuthenticationCredential) credential;\n            val principalId = remoteCookieCipherExecutor.decode(addressCredential.getCookie());\n            return new DefaultAuthenticationHandlerExecutionResult(this, addressCredential,\n                principalFactory.createPrincipal(principalId));\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        }\n        throw new FailedLoginException(\"Unable to accept cookie for authentication\");\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":57,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-generic-remote-webflow/src/main/java/org/apereo/cas/adaptors/generic/remote/RemoteCookieAuthenticationHandler.java#L36-L57","documentation":"RemoteCookieAuthenticationHandler authenticates users presenting a cookie whose value is encrypted by the remote cookie cipher executor. When decode of the cookie throws (bad key, malformed/garbage cookie, blank principal) the handler catches the exception, logs it, and throws FailedLoginException 'Unable to accept cookie for authentication', so the underlying cause is only visible in logs.","triggerScenarios":"Calling authenticate() with a RemoteUserCookieAddressCredential whose getCookie() value cannot be decrypted by remoteCookieCipherExecutor.decode() or yields a blank principalId.","commonSituations":"Cipher/encryption keys changed or differ between nodes issuing and accepting the cookie; cookie was tampered with or truncated; cookie issued by an older CAS version with a different cipher config; cookie expired or forged.","solutions":["Check server logs for the LoggingUtils.error stack trace above this exception to see the real decode failure","Ensure cas.authn.remote... cipher encryption/signing keys are identical across all CAS nodes and clients issuing the cookie","Clear stale cookies and re-obtain a fresh cookie from the issuing service","Verify the cookie value is not URL-encoded/truncated in transit before reaching the handler"],"exampleFix":"// before: cookie encrypted with mismatched key on node B\n// after: align keys in both nodes' properties\n# cas.authn.remote-cookie.crypto.encryption.key=...same-value...\n# cas.authn.remote-cookie.crypto.signing.key=...same-value...","handlingStrategy":"validation","validationCode":"if (credential == null || credential.getCookie() == null || credential.getCookie().isBlank()) {\n    throw new IllegalArgumentException(\"Remote cookie credential has no cookie value\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return handler.authenticate(credential);\n} catch (FailedLoginException e) {\n    // inspect server logs for the swallowed decode cause; reject request 401\n}","preventionTips":["Keep cipher encryption/signing keys in sync across all CAS nodes","Never persist or replay cookies across key rotations","Monitor logs for decode errors to detect key mismatch early"],"tags":["authentication","cookie","decryption","failed-login"],"backgroundTag":"missing-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}