{"record":{"id":"e91e524115c6ea5d","repo":"halo-dev/halo","slug":"cookie-token-did-not-contain-3-or-4-tokens-but-co","errorCode":null,"errorMessage":"Cookie token did not contain 3 or 4 tokens, but contained '{}'","messagePattern":"Cookie token did not contain 3 or 4 tokens, but contained '(.+?)'","errorType":"validation","errorClass":"InvalidCookieException","httpStatus":null,"severity":"error","filePath":"application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java","lineNumber":139,"sourceCode":"        } else if (ex instanceof UsernameNotFoundException) {\n            log.debug(\"Remember-me login was valid but corresponding user not found.\", ex);\n        } else if (ex instanceof InvalidCookieException) {\n            log.debug(\"Invalid remember-me cookie: {}\", ex.getMessage());\n        } else if (ex instanceof AccountStatusException) {\n            log.debug(\"Invalid UserDetails: {}\", ex.getMessage());\n        } else if (ex instanceof RememberMeAuthenticationException) {\n            log.debug(ex.getMessage());\n        }\n        return Mono.empty();\n    }\n\n    protected void cancelCookie(ServerWebExchange exchange) {\n        rememberMeCookieResolver.expireCookie(exchange);\n    }\n\n    protected Mono<UserDetails> processAutoLoginCookie(String[] cookieTokens, ServerWebExchange exchange) {\n        if (!isValidCookieTokensLength(cookieTokens)) {\n            throw new InvalidCookieException(\n                    \"Cookie token did not contain 3 or 4 tokens, but contained '\" + Arrays.asList(cookieTokens) + \"'\");\n        }\n\n        long tokenExpiryTime = getTokenExpiryTime(cookieTokens);\n        if (isTokenExpired(tokenExpiryTime)) {\n            throw new InvalidCookieException(\"Cookie token[1] has expired (expired on '\" + new Date(tokenExpiryTime)\n                    + \"'; current time is '\" + new Date() + \"')\");\n        }\n\n        // Check the user exists. Defer lookup until after expiry time checked, to\n        // possibly avoid expensive database call.\n        return getUserDetailsService()\n                .findByUsername(cookieTokens[0])\n                .switchIfEmpty(Mono.error(new UsernameNotFoundException(\"User '\" + cookieTokens[0] + \"' not found\")))\n                .flatMap(userDetails -> {\n                    // Check signature of token matches remaining details. Must do this after user\n                    // lookup, as we need the DAO-derived password. If efficiency was a major issue,\n                    // just add in a UserCache implementation, but recall that this method is usually","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/halo-dev/halo/blob/d2f5165f9c8f055ffcb3fa9c3f4032821a7b68c8/application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java#L121-L157","documentation":"Error \"Cookie token did not contain 3 or 4 tokens, but contained '{}'\" thrown in halo-dev/halo.","triggerScenarios":"Thrown at application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java:139 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Clear the remember-me cookie in the browser and log in again; the cookie is malformed or corrupted.","If the error persists, check for a changed 'remember-me' key or cookie configuration between restarts.","Ensure no proxy or browser extension is modifying the cookie value in transit."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d2f5165f9c8f055ffcb3fa9c3f4032821a7b68c8","analyzedAt":"2026-08-14T00:18:38.915Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}