{"record":{"id":"ff39fc5f09132367","repo":"passbolt/passbolt_api","slug":"the-code-is-required-in-request-data","errorCode":null,"errorMessage":"The code is required in request data.","messagePattern":"The code is required in request data\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Controller/AbstractSsoController.php","lineNumber":164,"sourceCode":"    public function getCodeFromUrlQuery(): string\n    {\n        $code = $this->request->getQuery('code');\n        if (!isset($code) || !is_string($code)) {\n            throw new BadRequestException(__('The code is required in URL parameters.'));\n        }\n\n        return $code;\n    }\n\n    /**\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the code (access token) is not provided in request data\n     * @return string code\n     */\n    public function getCodeFromRequestData(): string\n    {\n        $code = $this->getRequest()->getData('code');\n        if (!isset($code) || !is_string($code)) {\n            throw new BadRequestException(__('The code is required in request data.'));\n        }\n\n        return $code;\n    }\n\n    /**\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user_id is not provided in URL query\n     * @return \\App\\Utility\\ExtendedUserAccessControl\n     */\n    public function getUacFromData(): ExtendedUserAccessControl\n    {\n        $userId = $this->request->getData('user_id');\n        if (!isset($userId) || !is_string($userId)) {\n            throw new BadRequestException(__('The user id is required in URL parameters.'));\n        }\n\n        return $this->getUacFromUserIdAndRequest($userId);\n    }","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Controller/AbstractSsoController.php#L146-L182","documentation":"The POST-based SSO verification endpoints require a 'code' field in the request data (the authorization code or verify code). If it is unset or not a string, the controller throws this 400 because the subsequent state/token exchange cannot proceed.","triggerScenarios":"POST to an SSO endpoint that calls getCodeFromRequestData() with a body missing 'code', or where 'code' is not a string (null, object, number) — including bodies sent with the wrong Content-Type so the data does not parse.","commonSituations":"Client bug omitting the code field in the stage2 payload; JSON sent without Content-Type: application/json so getData() sees an empty array; legacy client versions using a different payload schema; proxy/gateway stripping the body.","solutions":["Include the 'code' string field in the request body exactly as issued in the earlier step.","Send the request with the correct Content-Type (application/json) so CakePHP parses the body into request data.","Restart the SSO flow if the code was already consumed — get a fresh one from stage1.","Upgrade/fix the client integration to the current SSO v2 payload schema."],"exampleFix":"// before\nfetch('/sso/verify', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({state})});\n// after\nfetch('/sso/verify', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({state, code: authCode})});","handlingStrategy":"type-guard","validationCode":"if (typeof code !== 'string' || code.length === 0) { throw new Error('code must be a non-empty string before POSTing'); }\nawait fetch(url, {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({state, code})});","typeGuard":"function isNonEmptyString(v) { return typeof v === 'string' && v.length > 0; }","tryCatchPattern":"try { await api.post('/sso/verify', {state, code}); } catch (e) { if (e.status === 400 && /code is required in request data/.test(e.message)) { checkPayloadAndContentType(); } else { throw e; } }","preventionTips":["Always include the code field as a string in the POST body","Set Content-Type: application/json so the body parses","Keep client payload schema in sync with SSO v2 API","Fetch a fresh code if the previous one was consumed"],"tags":["sso","missing-parameter","request-data","validation"],"backgroundTag":"empty-required-field","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}