{"record":{"id":"f57fc330ccc553f9","repo":"phacility/phabricator","slug":"this-request-included-an-improperly-formatted-mfa","errorCode":null,"errorMessage":"This request included an improperly formatted MFA challenge token and can not be processed.","messagePattern":"This request included an improperly formatted MFA challenge token and can not be processed\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/auth/storage/PhabricatorAuthChallenge.php","lineNumber":77,"sourceCode":"    $token_list = $request->getStr(self::HTTPKEY);\n    if ($token_list === null) {\n      return;\n    }\n    $token_list = explode(' ', $token_list);\n\n    $token_map = array();\n    foreach ($token_list as $token_element) {\n      $token_element = trim($token_element, ' ');\n\n      if (!strlen($token_element)) {\n        continue;\n      }\n\n      // NOTE: This error message is intentionally not printing the token to\n      // avoid disclosing it. As a result, it isn't terribly useful, but no\n      // normal user should ever end up here.\n      if (!preg_match('/^[^:]+:/', $token_element)) {\n        throw new Exception(\n          pht(\n            'This request included an improperly formatted MFA challenge '.\n            'token and can not be processed.'));\n      }\n\n      list($phid, $token) = explode(':', $token_element, 2);\n\n      if (isset($token_map[$phid])) {\n        throw new Exception(\n          pht(\n            'This request improperly specifies an MFA challenge token (\"%s\") '.\n            'multiple times and can not be processed.',\n            $phid));\n      }\n\n      $token_map[$phid] = new PhutilOpaqueEnvelope($token);\n    }\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/storage/PhabricatorAuthChallenge.php#L59-L95","documentation":"PhabricatorAuthChallenge::newChallengeResponsesFromRequest() parses the request's MFA challenge token list: each non-empty element must match '^[^:]+:' (a challenge PHID, colon, then the token). Elements that do not look like 'PHID:token' trigger this exception; the source comment notes the message deliberately does not echo the token to avoid disclosure, and that no normal user should ever reach it.","triggerScenarios":"A request carries mfa challenge parameters not shaped like '<PHID>:<token>' - a hand-crafted or scripted request, a tampered form payload, or buggy client code that mangles the hidden MFA inputs the form generated via newHTTPParametersFromChallenges().","commonSituations":"Scripts or API clients poking MFA-protected endpoints with made-up parameters; browser extensions altering form fields; copy/paste corruption of hidden inputs.","solutions":["Do not hand-craft MFA challenge parameters - replay exactly the values the rendered form generated","Retry the operation from the normal UI so fresh, well-formed challenge inputs are produced","If you control the client, debug what it actually submits for the mfa parameters and stop modifying them"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client-side: never fabricate mfa parameters; only echo back what the\n// server generated:\n$params = PhabricatorAuthChallenge::newHTTPParametersFromChallenges($challenges);\n// ...render $params as hidden inputs; on submit, re-validate shape:\nforeach ($submitted_mfa as $element) {\n  $element = trim($element, ' ,');\n  if (strlen($element) && !preg_match('/^[^:]+:/', $element)) {\n    unset($submitted_mfa[$element]); // drop malformed instead of fataling\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  $responses = PhabricatorAuthChallenge::newChallengeResponsesFromRequest(\n    $challenges, $request);\n} catch (Exception $ex) {\n  // Malformed client payload: answer 400, do not retry the same request.\n  return new Aphront400Response();\n}","preventionTips":["Always generate MFA request parameters via newHTTPParametersFromChallenges() and submit them untouched","Treat this exception as a client bug or tampering signal - log the request shape, never the token","Restart the MFA flow from the UI instead of replaying modified forms"],"tags":["mfa","phabricator","request-validation","token-format"],"backgroundTag":"mfa-challenge-token-invalid","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}