{"record":{"id":"c50dc3cbd9a2510c","repo":"passbolt/passbolt_api","slug":"no-active-refresh-token-matching-the-request-could-be-found-c50dc3","errorCode":null,"errorMessage":"No active refresh token matching the request could be found.","messagePattern":"No active refresh token matching the request could be found\\.","errorType":"http","errorClass":"RefreshTokenNotFoundException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/JwtAuthentication/src/Service/RefreshToken/RefreshTokenAuthenticationService.php","lineNumber":42,"sourceCode":" */\nclass RefreshTokenAuthenticationService extends RefreshTokenAbstractService\n{\n    /**\n     * Fetch the user from a provided refresh token.\n     *\n     * @param string|null $token Token to retrieve\n     * @return string refresh token\n     * @throws \\InvalidArgumentException if the token is not a valid UUIDs\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\RefreshToken\\RefreshTokenNotFoundException When there is no user associated to this token.\n     */\n    public function getUserIdFromToken(?string $token): string\n    {\n        $this->validateRefreshToken($token);\n\n        try {\n            return $this->queryRefreshToken($token)->firstOrFail()->get('user_id');\n        } catch (RecordNotFoundException $e) {\n            throw new RefreshTokenNotFoundException();\n        }\n    }\n}\n","sourceCodeStart":24,"sourceCodeEnd":46,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Service/RefreshToken/RefreshTokenAuthenticationService.php#L24-L46","documentation":"getUserIdFromToken validates the token UUID and then queries for an active refresh token; if no row matches it throws RefreshTokenNotFoundException ('No active refresh token matching the request could be found'). This means the token is unknown, inactive, or associated with no active session for the authentication flow.","triggerScenarios":"Authenticating the refresh-token flow (JwtRefreshTokenAuthenticator / getUserIdFromToken) with a token id that is not present as an active AuthenticationToken — already consumed, revoked, deleted, or never issued.","commonSituations":"Client using a refresh token from a different environment (staging vs prod DB); token revoked by an admin or by logout; database re-provisioning wiping authentication_tokens; sending the access token's jti instead of the refresh token id.","solutions":["Log in again to obtain a valid refresh token; the presented one has no active record.","Verify the client targets the same passbolt instance/environment where the token was issued.","Check the authentication_tokens table for the token id and its active flag to confirm revocation status.","Confirm the request sends the refresh token id (UUID) in the expected request field, not another token value."],"exampleFix":"// before\nconst userId = await authService.getUserIdFromToken(parsedBody.access_token); // wrong token\n// after\nconst userId = await authService.getUserIdFromToken(parsedBody.refresh_token); // active UUID token","handlingStrategy":"try-catch","validationCode":"if (!isUuid(refreshToken)) throw new Error('send the refresh token UUID, not the access token');","typeGuard":null,"tryCatchPattern":"try {\n  $userId = $authService->getUserIdFromToken($token);\n} catch (RefreshTokenNotFoundException $e) {\n  throw new AuthenticationException('Unknown or revoked refresh token; re-authenticate', 401, $e);\n}","preventionTips":["Point clients at the correct environment; tokens are DB-scoped","After admin revocation or DB restore, force re-login","Send the refresh token UUID in the expected field, not an access token id"],"tags":["refresh-token","not-found","jwt","authentication"],"backgroundTag":"resource-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}