passbolt/passbolt_api · error · BadRequestException

Ajax/Json request not supported.

Error message

Ajax/Json request not supported.

What it means

ssoSuccess() is the browser-only OAuth2 redirect endpoint; it immediately rejects any request flagged as JSON/Ajax with BadRequestException. The SSO success flow expects a real HTTP redirect from the identity provider, not an API call.

Solutions

  1. Remove the JSON accept header / Ajax flags and open /sso/success in a regular browser navigation flow
  2. Check client code is not using fetch/axios to call this URL; the URL should be the OAuth redirect target
  3. If you need token exchange programmatically, use the dedicated SSO API endpoints instead of the success redirect endpoint

Example fix

// before
curl -H 'Accept: application/json' https://passbolt.example.com/sso/success
// after
# navigate in browser, no JSON header:
curl -L https://passbolt.example.com/sso/success
Defensive patterns

Strategy: validation

Validate before calling

if (strpos($_SERVER['HTTP_ACCEPT'] ?? '', 'application/json') !== false) {
    // do not call /sso/success via API; open in browser instead
}

Try / catch

try {
    $resp = $httpClient->get($successUrl, ['headers' => ['Accept' => 'text/html']]);
} catch (\Passbolt\WebInstaller\Error\Exception\BadRequestException $e) {
    // fall back to browser navigation
}

Prevention

When it happens

Trigger: Calling GET /sso/success with the Accept: application/json header or the CakePHP ?_ext=json / JSON extensions enabled, e.g. when an API client or a browser extension forces JSON content negotiation.

Common situations: Developers testing the endpoint via Postman/curl with JSON accept headers; passbolt desktop/cli clients misconfigured to hit the web redirect URL; front-end code fetching the success URL instead of following the redirect in a browser window.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/c61fed0bec356ef8. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Controller/Success/SsoSuccessDryRunController.php:32

 * @link          https://www.passbolt.com Passbolt(tm)
 * @since         3.9.0
 */

namespace Passbolt\Sso\Controller\Success;

use Cake\Http\Exception\BadRequestException;
use Passbolt\Sso\Controller\AbstractSsoController;

class SsoSuccessDryRunController extends AbstractSsoController
{
    /**
     * @return void
     * @throws \League\OAuth2\Client\Provider\Exception\IdentityProviderException
     */
    public function ssoSuccess(): void
    {
        if ($this->request->is('json')) {
            throw new BadRequestException(__('Ajax/Json request not supported.'));
        }

        $this->User->assertIsAdmin();
        $this->getTokenFromUrlQuery();

        // Not much to do
        $this->viewBuilder()
            ->setLayout('default')
            ->setTemplatePath('success')
            ->setTemplate('stage3');
    }
}

View on GitHub (pinned to 31c1bbc10f)