{"record":{"id":"c99875c9614aebe7","repo":"apereo/cas","slug":"could-not-determine-authentication-from-the-reques","errorCode":null,"errorMessage":"Could not determine authentication from the request context","messagePattern":"Could not determine authentication from the request context","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-trusted-mfa-core/src/main/java/org/apereo/cas/trusted/web/flow/MultifactorAuthenticationVerifyTrustAction.java","lineNumber":48,"sourceCode":"@RequiredArgsConstructor\n@Getter\npublic class MultifactorAuthenticationVerifyTrustAction extends BaseCasWebflowAction {\n\n    private final MultifactorAuthenticationTrustStorage storage;\n\n    private final DeviceFingerprintStrategy deviceFingerprintStrategy;\n\n    private final TrustedDevicesMultifactorProperties trustedProperties;\n\n    private final AuditableExecution registeredServiceAccessStrategyEnforcer;\n\n    private final MultifactorAuthenticationTrustedDeviceBypassEvaluator bypassEvaluator;\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val authentication = WebUtils.getAuthentication(requestContext);\n        if (authentication == null) {\n            LOGGER.warn(\"Could not determine authentication from the request context\");\n            return no();\n        }\n        val registeredService = WebUtils.getRegisteredService(requestContext);\n        val service = WebUtils.getService(requestContext);\n\n        val trustedDevicesDisabled = MultifactorAuthenticationTrustUtils.isMultifactorAuthenticationTrustedDevicesDisabled(requestContext);\n        val publicWorkstation = WebUtils.isAuthenticatingAtPublicWorkstation(requestContext);\n        if (publicWorkstation || trustedDevicesDisabled || bypassEvaluator.shouldBypassTrustedDevice(registeredService, service, authentication)) {\n            LOGGER.debug(\"Trusted device registration is disabled for [{}]\", registeredService);\n            return result(CasWebflowConstants.TRANSITION_ID_SKIP);\n        }\n        val principal = authentication.getPrincipal().getId();\n        LOGGER.trace(\"Retrieving trusted authentication records for [{}]\", principal);\n        val results = storage.isAvailable() ? storage.get(principal) : Set.<MultifactorAuthenticationTrustRecord>of();\n        if (results.isEmpty()) {\n            LOGGER.debug(\"No valid trusted authentication records could be found for [{}]\", principal);\n            return no();\n        }","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-trusted-mfa-core/src/main/java/org/apereo/cas/trusted/web/flow/MultifactorAuthenticationVerifyTrustAction.java#L30-L66","documentation":"MultifactorAuthenticationVerifyTrustAction.doExecuteInternal begins by reading the current Authentication from the webflow request context. When none is present, the action logs this warning and returns the 'no' event, meaning the device cannot be verified as trusted and the flow proceeds as if the device is not trusted.","triggerScenarios":"The trusted-device verification webflow action executes in a request context where WebUtils.getAuthentication(requestContext) is null — i.e. the flow reached the MFA trust check without an established authentication (flow invoked out of order or authentication not yet stored in the flow scope).","commonSituations":"Direct/deep-link access to the MFA trust flow without a prior login step; custom flow modifications that skip authentication setup; session expiry combined with flow resumption; misordered MFA subflow configuration.","solutions":["Ensure the standard CAS login flow (which establishes authentication in flow scope) precedes the MFA trust verification subflow.","Check for custom webflow overrides that bypass the authentication setup step.","Verify the session/flow is not expired or resumed without re-establishing authentication.","Review MFA trigger/bypass configuration so this action only runs after authentication."],"exampleFix":"// ensure authentication is available before invoking the action\nval authentication = WebUtils.getAuthentication(requestContext);\nif (authentication == null) {\n    // route user through login flow instead of continuing trust check\n    return no();\n}","handlingStrategy":"type-guard","validationCode":"// guard flow entry: only invoke trust verification when authentication exists\nAuthentication auth = WebUtils.getAuthentication(requestContext);\nif (auth == null) {\n    LOGGER.warn(\"Trust check requires authentication; redirecting to login\");\n    return error();\n}","typeGuard":"boolean hasAuthentication(RequestContext ctx) {\n    return WebUtils.getAuthentication(ctx) != null;\n}","tryCatchPattern":null,"preventionTips":["Never deep-link into MFA subflows outside the standard login flow.","Keep default webflow ordering; review custom flow overrides for skipped steps.","Test session-expiry resumption paths in MFA-enabled deployments."],"tags":["mfa","webflow","authentication","trusted-devices"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}