{"record":{"id":"eee8e0808b3ce1a9","repo":"AdguardTeam/AdGuardHome","slug":"decoding-value-w","errorCode":null,"errorMessage":"decoding value: %w","messagePattern":"decoding value: %w","errorType":"http","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"internal/home/authhttp.go","lineNumber":547,"sourceCode":"\t}\n\n\tif s == nil {\n\t\treturn nil, nil\n\t}\n\n\tu, err = mw.users.ByLogin(ctx, s.UserLogin)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"searching user by login %q: %w\", s.UserLogin, err)\n\t}\n\n\treturn u, nil\n}\n\n// sessionTokenFromHex converts a hexadecimal string into a session token.\nfunc sessionTokenFromHex(val string) (token aghuser.SessionToken, err error) {\n\tsess, err := hex.DecodeString(val)\n\tif err != nil {\n\t\treturn token, fmt.Errorf(\"decoding value: %w\", err)\n\t}\n\n\tl := aghuser.SessionTokenLength\n\n\terr = validate.Equal(\"token length\", l, len(sess))\n\tif err != nil {\n\t\t// Don't wrap the error because it's informative enough as is.\n\t\treturn token, err\n\t}\n\n\treturn aghuser.SessionToken(sess), nil\n}\n\n// userFromRequestBasicAuth searches for a user using Basic Auth credentials.  r\n// must not be nil.\nfunc (mw *authMiddlewareDefault) userFromRequestBasicAuth(\n\tctx context.Context,\n\tr *http.Request,","sourceCodeStart":529,"sourceCodeEnd":565,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/authhttp.go#L529-L565","documentation":"The session cookie value is not valid hexadecimal, so it cannot be decoded into a session token. This points to a malformed, tampered, or truncated cookie rather than a stale one.","triggerScenarios":"handleLogout or userFromCookie receiving a cookie whose value contains non-hex characters (e.g. edited by hand, wrong encoding, or garbage from another app on the same host/path).","commonSituations":"Manually crafted cookies, cookie corruption by a proxy, browsers storing overlapping cookie values, or client code sending the wrong cookie.","solutions":["Clear the browser cookies for the AdGuard Home host and log in again","Verify client code sends the exact cookie value previously issued (hex string of SessionTokenLength bytes)","Check that no intermediary rewrites or truncates Cookie headers"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate cookie is hex of expected length before sending\nraw, err := hex.DecodeString(cookieValue)\nif err != nil || len(raw) != 32 { /* discard cookie */ }","typeGuard":"func isValidSessionCookie(v string) bool {\n    b, err := hex.DecodeString(v)\n    return err == nil && len(b) == 32\n}","tryCatchPattern":null,"preventionTips":["Store issued cookie values verbatim; never re-encode or truncate","Scope cookies to the right host/path to avoid clashes"],"tags":["auth","cookie","hex-decode","session"],"backgroundTag":"malformed-session-cookie","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}