passbolt/passbolt_api · error · InternalErrorException

Could not create MFA verified cookie.

Error message

Could not create MFA verified cookie.

What it means

Wraps any failure while generating the MFA verified cookie after a successful Duo 2FA callback. The Duo provider has verified the user, but building the signed MfaVerifiedCookie (via MfaVerifiedCookieService::createDuoMfaVerifiedCookie) threw, so the server escalates to a 500 InternalErrorException with the original exception attached as 'previous'.

Solutions

1. Inspect the previous exception in the error log for the root cause
2. Verify Duo organization settings (host, ikey, skey) are present and valid
3. Run a database/cache health check; refresh app state if session storage is failing
4. Ensure MfaVerifiedCookieService dependencies (session identification, request) are wired correctly

const duoConfigured = orgSettings?.mfa?.providers?.duo != null;
if (!duoConfigured) throw new Error('Duo org settings missing; skip MFA cookie flow');

try { const cookie = createDuoMfaVerifiedCookie(uac, session, req); } catch (e) { logger.error('mfa cookie failed', { cause: e }); throw new InternalError('Could not create MFA verified cookie.', e); }

When it happens

Trigger: Any Throwable raised inside createDuoMfaVerifiedCookie during DuoVerifyCallbackGetController::get: invalid/incomplete UAC, Duo org settings missing or malformed, session identification failure, or request state (cookies/params) the cookie service cannot consume.

Common situations: Duo API not configured in org settings, expired or missing Duo session data, misconfigured security salt used for cookie signing, or an unrelated bug in the cookie service after a Duo login flow change.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• A Duo state cookie is required.
• A Duo state cookie is required.
• An authentication token state is required.
• Could not enable Duo MFA provider.
• Could not enable Duo MFA provider.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0d14c89bbdd04ddb. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/Duo/DuoVerifyCallbackGetController.php:213

     * Add to the response the MFA verified cookie.
     *
     * @param \App\Utility\UserAccessControl $uac User access control
     * @param \App\Authenticator\SessionIdentificationServiceInterface $sessionIdentificationService session ID service
     * @return void
     * @throws \Cake\Http\Exception\InternalErrorException if it cannot create MFA cookie
     */
    private function addMfaVerifiedCookieToResponse(
        UserAccessControl $uac,
        SessionIdentificationServiceInterface $sessionIdentificationService
    ): void {
        try {
            $cookie = (new MfaVerifiedCookieService())->createDuoMfaVerifiedCookie(
                $uac,
                $sessionIdentificationService,
                $this->getRequest()
            );
        } catch (Throwable $e) {
            throw new InternalErrorException('Could not create MFA verified cookie.', null, $e);
        }

        $this->setResponse($this->getResponse()->withCookie($cookie));
    }

    /**
     * Redirect the user if the authentication token contains a redirect path.
     *
     * @param \App\Model\Entity\AuthenticationToken $authenticationToken The authentication token
     * @return void
     */
    private function redirectIfDefinedInToken(AuthenticationToken $authenticationToken): void
    {
        $redirect = $authenticationToken->getDataValue('redirect');
        if (!empty($redirect) && substr($redirect, 0, 1) === '/') { // redirect path must start with / (internal link)
            $this->redirect($redirect);
        }
    }

View on GitHub (pinned to 31c1bbc10f)