passbolt/passbolt_api · warning · FormValidationException

Could not validate the SSO recover request.

Error message

Could not validate the SSO recover request.

What it means

Thrown when SsoRecoverStartForm::execute() fails validation of the posted data (typically the username/email field). A FormValidationException is raised with this generic message; the detailed field errors are attached to the form object and returned in the error response body.

Solutions

1. Inspect the error response body for per-field validation details
2. Send {"username": "<valid-email>"} in the JSON body
3. Trim whitespace and validate the email client-side before calling
4. Align request field names with SsoRecoverStartForm's schema

Example fix

// before
{"user": "alice@example.com"}   // wrong field name
// after
{"username": "alice@example.com"}

const emailRe = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
if (typeof username !== 'string' || !emailRe.test(username.trim())) {
  throw new Error('username must be a valid email address');
}

const isValidUsername = (v) => typeof v === 'string' && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v.trim());

try {
  await ssoRecoverStart({username});
} catch (e) {
  if (e.message.includes('Could not validate')) console.warn(e.formErrors ?? 'Check username field');
  else throw e;
}

When it happens

Trigger: POST /sso/recover/start with missing username, an email not matching validation rules, or extra malformed fields; empty request body.

Common situations: API client omits the username field or sends it under the wrong key; email contains whitespace or invalid format; client sends form-encoded data where field names don't match the form schema.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not save the SSO state, invalid nonce.
• Invalid status.
• Service provider missing.
• Service provider not supported.
• Something went wrong when validating the single-sign on…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7561c4f27ed314ca. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/RecoverStartController.php:67

     */
    public function start(): void
    {
        if (!$this->request->is('json')) {
            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));
        }

        $this->User->assertNotLoggedIn();

        // Make sure SSO settings are set.
        try {
            $settingsDto = (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('No valid SSO settings found.'), null, $e);
        }

        $form = new SsoRecoverStartForm();
        if (!$form->execute($this->getRequest()->getData())) {
            throw new FormValidationException(__('Could not validate the SSO recover request.'), $form);
        }

        // Assert & consume sso auth token
        $ssoAuthService = new SsoAuthenticationTokenGetService();
        try {
            $ssoAuthToken = $ssoAuthService->getOrFail(
                $form->getData('token'),
                SsoState::TYPE_SSO_RECOVER
            );
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException($e->getMessage(), null, $e);
        }

        $uac = new ExtendedUserAccessControl(
            Role::GUEST,
            $ssoAuthToken->user_id,
            null,
            $this->User->ip(),

View on GitHub (pinned to 31c1bbc10f)