{"record":{"id":"f997a30f53a4a057","repo":"phacility/phabricator","slug":"your-browser-did-not-submit-a-s-cookie-with-cli","errorCode":null,"errorMessage":"Your browser did not submit a \"%s\" cookie with client state information in the request. Check that cookies are enabled. If this problem persists, you may need to clear your cookies.","messagePattern":"Your browser did not submit a \"(.+?)\" cookie with client state information in the request\\. Check that cookies are enabled\\. If this problem persists, you may need to clear your cookies\\.","errorType":"http","errorClass":"AphrontMalformedRequestException","httpStatus":400,"severity":"warning","filePath":"src/applications/auth/provider/PhabricatorAuthProvider.php","lineNumber":549,"sourceCode":"\n    return phabricator_form(\n      $viewer,\n      array(\n        'method' => idx($attributes, 'method', 'GET'),\n        'action' => (string)$uri,\n        'sigil'  => idx($attributes, 'sigil'),\n      ),\n      $content);\n  }\n\n  public function renderConfigurationFooter() {\n    return null;\n  }\n\n  public function getAuthCSRFCode(AphrontRequest $request) {\n    $phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);\n    if (!strlen($phcid)) {\n      throw new AphrontMalformedRequestException(\n        pht('Missing Client ID Cookie'),\n        pht(\n          'Your browser did not submit a \"%s\" cookie with client state '.\n          'information in the request. Check that cookies are enabled. '.\n          'If this problem persists, you may need to clear your cookies.',\n          PhabricatorCookies::COOKIE_CLIENTID),\n        true);\n    }\n\n    return PhabricatorHash::weakDigest($phcid);\n  }\n\n  protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {\n    $expect = $this->getAuthCSRFCode($request);\n\n    if (!strlen($actual)) {\n      throw new Exception(\n        pht(","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/provider/PhabricatorAuthProvider.php#L531-L567","documentation":"Thrown by PhabricatorAuthProvider::getAuthCSRFCode() when the browser submitted no 'phcid' client-state cookie (PhabricatorCookies::COOKIE_CLIENTID). The provider derives the expected OAuth 'state' value from a weak digest of this cookie, so the cookie is mandatory for any CSRF-protected auth handshake. It is raised as an AphrontMalformedRequestException with a user-facing title ('Missing Client ID Cookie') so Phabricator renders a friendly page rather than a raw stack trace.","triggerScenarios":"Initiating a login/registration handshake (e.g. OAuth provider callback) in a browser where the phcid cookie was never set or was not sent: cookies blocked by browser settings or an extension, third-party-cookie blocking when Phabricator is embedded in an iframe, a browser in private mode with cookies rejected, or cookies cleared between the request that set phcid and the callback.","commonSituations":"Corporate browsers with strict cookie policies; users in incognito; Safari ITP dropping the cookie; Phabricator loaded inside another product's frame; cookie domain/path mismatches after a hostname change so the cookie never comes back.","solutions":["Tell the user to enable cookies for the Phabricator origin and retry the login from a fresh tab.","Have the user clear existing Phabricator cookies (stale phcid from an old domain can be as bad as none), then reload the login page so a fresh phcid is issued.","If Phabricator is iframed, open the auth flow in a top-level window — third-party-cookie blocking prevents phcid from being sent.","Verify the site is served from one consistent canonical domain (no mixed www/apex or http/https flips) so the Set-Cookie on phcid actually survives to the callback."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// In a custom provider/controller, check the cookie before starting the flow\nif (!strlen($request->getCookie(PhabricatorCookies::COOKIE_CLIENTID))) {\n  // render a 'enable cookies' notice instead of beginning the handshake\n}","typeGuard":null,"tryCatchPattern":"try {\n  $code = $provider->getAuthCSRFCode($request);\n} catch (AphrontMalformedRequestException $ex) {\n  // already user-friendly: re-render the login page with $ex->getTitle()\n  // and $ex->getURI()/message; do not retry automatically\n}","preventionTips":["Serve Phabricator from one canonical origin so the phcid cookie survives the whole flow.","Open auth flows in top-level windows, not iframes, to avoid third-party-cookie blocking.","Include a 'cookies must be enabled' hint on customized login pages."],"tags":["phabricator","auth","csrf","cookies","browser-config"],"backgroundTag":"missing-cookie","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}