passbolt/passbolt_api · error · BadRequestException

Conflicting authentication parameters, provide…

Error message

Conflicting authentication parameters, provide user_id/token only when the user is not already signed in.

What it means

A BadRequestException thrown by assertQueryParameters() when the caller is already authenticated (session present) but the request also supplies user_id and/or token query parameters. The controller treats this session/token mix as ambiguous and refuses the request rather than guessing which identity applies.

Solutions

1. Remove the user_id and token query parameters from the request when a session is already authenticated.
2. Ensure the client only builds guest-style URLs (with user_id/token) when not signed in.
3. Clear stale cookies or sign out if the session is unintended and the guest token flow is actually desired.

Example fix

// before
GET /user-key-policies/settings.json?user_id=0d2f...&token=9a1b...
// after (when already signed in)
GET /user-key-policies/settings.json

const isSignedIn = Boolean(sessionCookie);
const hasGuestParams = url.searchParams.has('user_id') || url.searchParams.has('token');
if (isSignedIn && hasGuestParams) {
  url.searchParams.delete('user_id');
  url.searchParams.delete('token');
}

catch (e) {
  if (e.response?.status === 400 && /Conflicting authentication parameters/.test(e.response.data?.message)) {
    // strip user_id/token params and retry
  }
}

When it happens

Trigger: GET /user-key-policies/settings made with an authenticated session while still passing ?user_id=<uuid>&token=<uuid> query parameters, typically by client code that blindly appends guest credentials.

Common situations: Client SDK or script built for the guest flow reused inside an authenticated browser session; leftover query params in a template/link after sign-in; integration tests where a logged-in fixture also passes token params.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• An authentication token should be provided.
• Multiple has-access filters are not supported.
• The authentication failed. The credentials are missing.
• The authentication token is not valid or has expired.
• The user ID must be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/23b34cb52daa43c7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/UserKeyPolicies/src/Controller/UserKeyPoliciesGetSettingsController.php:85

    /**
     * This method verifies that a guest user can be authenticated with a valid user ID and authentication token.
     *
     * @return void
     * @throws \Cake\Http\Exception\ForbiddenException If the user is a guest and neither a user ID nor an authentication token is provided.
     * @throws \Cake\Http\Exception\BadRequestException If the provided user ID is not a valid UUID.
     * @throws \Cake\Http\Exception\BadRequestException If the provided authentication token is not a valid UUID.
     * @throws \Cake\Http\Exception\ForbiddenException If no valid authentication token is found.
     */
    private function assertQueryParameters(): void
    {
        $isLoggedIn = !$this->User->isGuest();
        $isUserToken = $this->getRequest()->getQuery('user_id', false) || $this->getRequest()->getQuery('token', false);

        if ($isLoggedIn) {
            if ($isUserToken) {
                // session confusion: If user is logged in but still authentication token is provided we consider it bad request.
                throw new BadRequestException(__('Conflicting authentication parameters, provide user_id/token only when the user is not already signed in.')); // phpcs:ignore
            }

            return;
        }

        $userId = $this->getRequest()->getQuery('user_id');
        $authToken = $this->getRequest()->getQuery('token');

        if (is_null($userId) || is_null($authToken)) {
            throw new UnauthorizedException(
                __('You are not authorized to access this location.') . ' ' .
                __('Sign-in to passbolt, or provide a valid user ID and authentication token.')
            );
        }

        if (!Validation::uuid($userId)) {
            throw new BadRequestException(__('The user ID must be a valid UUID.'));
        }

View on GitHub (pinned to 31c1bbc10f)