{"record":{"id":"ca160b796157f07a","repo":"passbolt/passbolt_api","slug":"the-duo-state-cookie-should-be-a-valid-uuid-ca160b","errorCode":null,"errorMessage":"The Duo state cookie should be a valid UUID.","messagePattern":"The Duo state cookie should be a valid UUID\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/Duo/DuoVerifyCallbackGetController.php","lineNumber":188,"sourceCode":"     *\n     * @return string The token id stored in the cookie\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the cookie is not defined\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the cookie value is not a string\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the cookie value is not a valid uuid\n     */\n    private function consumeAndAssertCookieToken(): string\n    {\n        $cookieToken = (new MfaDuoStateCookieService())->readDuoStateCookieValue($this->getRequest());\n        if (is_null($cookieToken)) {\n            throw new BadRequestException(__('A Duo state cookie is required.'));\n        }\n        $cookieToExpire = new Cookie(MfaDuoStateCookieService::MFA_COOKIE_DUO_STATE);\n        $this->setResponse($this->getResponse()->withExpiredCookie($cookieToExpire));\n\n        if (!is_string($cookieToken)) {\n            throw new BadRequestException(__('The Duo state cookie value should be a string.'));\n        } elseif (!Validation::uuid($cookieToken)) {\n            throw new BadRequestException(__('The Duo state cookie should be a valid UUID.'));\n        }\n\n        return $cookieToken;\n    }\n\n    /**\n     * Add to the response the MFA verified cookie.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac User access control\n     * @param \\App\\Authenticator\\SessionIdentificationServiceInterface $sessionIdentificationService session ID service\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException if it cannot create MFA cookie\n     */\n    private function addMfaVerifiedCookieToResponse(\n        UserAccessControl $uac,\n        SessionIdentificationServiceInterface $sessionIdentificationService\n    ): void {\n        try {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/Duo/DuoVerifyCallbackGetController.php#L170-L206","documentation":"Format guard on the Duo state cookie during MFA callback verification: the cookie value, while a string, does not pass Validation::uuid(), so it cannot be the authentication token id the flow expects and a 400 is raised.","triggerScenarios":"GET /mfa/duo/verify/callback with a corrupted, truncated, or forged state cookie value that fails UUID validation.","commonSituations":"Proxy header truncation; URL encoding mangling the cookie; user-crafted cookies in security testing; leftover cookies from a differently formatted flow.","solutions":["Clear MFA cookies and restart the Duo verification flow to mint a fresh UUID state cookie.","Ensure no intermediary truncates or re-encodes the Cookie header.","Avoid manual cookie manipulation; rely on server-generated values.","Reproduce by comparing the cookie value against the UUID format (8-4-4-4-12 hex)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!uuidRe.test(cookies.passbolt_mfa_duo_state ?? '')) { throw new Error('Duo state cookie is not a valid UUID; restart flow.'); }","typeGuard":"function isValidUuid(value: unknown): value is string {\n  return typeof value === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);\n}","tryCatchPattern":"try {\n  await duoVerifyCallback();\n} catch (e) {\n  if (e.status === 400 && /valid UUID/.test(e.message)) {\n    clearMfaCookies(); restartDuoVerifyFlow();\n  } else { throw e; }\n}","preventionTips":["Restart the flow rather than reusing altered state cookie values.","Guard against header truncation in proxies/load balancers.","Validate cookie integrity (UUID shape) when instrumenting MFA debugging.","Avoid URL re-encoding layers on the passbolt domain."],"tags":["duo","mfa","cookie","uuid","validation"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}