halo-dev/halo · error · InvalidCookieException

Cookie token did not contain 3 or 4 tokens, but contained '{

Error message

Cookie token did not contain 3 or 4 tokens, but contained '{}'

What it means

Error "Cookie token did not contain 3 or 4 tokens, but contained '{}'" thrown in halo-dev/halo.

Source

Thrown at application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java:139

        } else if (ex instanceof UsernameNotFoundException) {
            log.debug("Remember-me login was valid but corresponding user not found.", ex);
        } else if (ex instanceof InvalidCookieException) {
            log.debug("Invalid remember-me cookie: {}", ex.getMessage());
        } else if (ex instanceof AccountStatusException) {
            log.debug("Invalid UserDetails: {}", ex.getMessage());
        } else if (ex instanceof RememberMeAuthenticationException) {
            log.debug(ex.getMessage());
        }
        return Mono.empty();
    }

    protected void cancelCookie(ServerWebExchange exchange) {
        rememberMeCookieResolver.expireCookie(exchange);
    }

    protected Mono<UserDetails> processAutoLoginCookie(String[] cookieTokens, ServerWebExchange exchange) {
        if (!isValidCookieTokensLength(cookieTokens)) {
            throw new InvalidCookieException(
                    "Cookie token did not contain 3 or 4 tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
        }

        long tokenExpiryTime = getTokenExpiryTime(cookieTokens);
        if (isTokenExpired(tokenExpiryTime)) {
            throw new InvalidCookieException("Cookie token[1] has expired (expired on '" + new Date(tokenExpiryTime)
                    + "'; current time is '" + new Date() + "')");
        }

        // Check the user exists. Defer lookup until after expiry time checked, to
        // possibly avoid expensive database call.
        return getUserDetailsService()
                .findByUsername(cookieTokens[0])
                .switchIfEmpty(Mono.error(new UsernameNotFoundException("User '" + cookieTokens[0] + "' not found")))
                .flatMap(userDetails -> {
                    // Check signature of token matches remaining details. Must do this after user
                    // lookup, as we need the DAO-derived password. If efficiency was a major issue,
                    // just add in a UserCache implementation, but recall that this method is usually

View on GitHub (pinned to d2f5165f9c)

Solutions

1. Clear the remember-me cookie in the browser and log in again; the cookie is malformed or corrupted.
2. If the error persists, check for a changed 'remember-me' key or cookie configuration between restarts.
3. Ensure no proxy or browser extension is modifying the cookie value in transit.

When it happens

Trigger: Thrown at application/src/main/java/run/halo/app/security/authentication/rememberme/TokenBasedRememberMeServices.java:139 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/e91e524115c6ea5d. Report an issue: GitHub.