passbolt/passbolt_api · warning · Cake\Http\Exception\BadRequestException

$exception->getMessage() (invalid cookie name, e.g. "The…

Error message

$exception->getMessage() (invalid cookie name, e.g. "The cookie name ... contains invalid characters.")

What it means

Passbolt's ValidCookieNameMiddleware eagerly parses the request cookie collection. PHP's cookie parser throws InvalidArgumentException when a cookie header contains an invalid name (e.g. spaces, brackets, illegal characters). The middleware catches it and remaps it to CakePHP's BadRequestException so the client gets a 400 instead of a 500.

Solutions

1. Inspect the Cookie header of the failing request and remove or fix the cookie with the invalid name.
2. Fix or update the client/proxy/extension generating the malformed cookie.
3. If the cookie is set by your own frontend, ensure names use only ASCII letters, digits, and '-' '_' per RFC 6265.
4. As a last resort, strip invalid cookies in an earlier middleware before cookie parsing.

Example fix

// before: malformed header
Cookie: my cookie=abc; other=1
// after
Cookie: my_cookie=abc; other=1

// Client-side: sanitize cookie names before sending
const validName = (name) => /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name);
if (!validName('my_cookie')) { console.error('invalid cookie name'); }

function hasValidCookieNames(header) {
  return header.split(';').every(c => {
    const name = c.split('=')[0].trim();
    return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name);
  });
}

try { $request->getCookieCollection(); } catch (InvalidArgumentException $e) {
  throw new BadRequestException('Request contains an invalid cookie.', null, $e);
}

When it happens

Trigger: An HTTP request arrives with a Cookie header containing a cookie whose name contains invalid characters (spaces, commas, semicolons, brackets, non-ASCII), so $request->getCookieCollection() throws.

Common situations: Misbehaving clients, browser extensions, proxies, or hand-built HTTP requests sending malformed cookies; legacy systems emitting cookie names with unquoted special characters.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• The route is not permitted with JWT authentication.
• A Duo state cookie is required.
• A Duo state cookie is required.
• Ajax/Json request not supported.
• Ajax/Json request not supported.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1fd38698b631d5c1. Report an issue: GitHub.

Appendix: source

Thrown at src/Middleware/ValidCookieNameMiddleware.php:43

class ValidCookieNameMiddleware implements MiddlewareInterface
{
    /**
     * Throws a bad request if the version passed in the request is not supported.
     *
     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
     * @param \Psr\Http\Server\RequestHandlerInterface $handler The request handler.
     * @return \Psr\Http\Message\ResponseInterface A response.
     * @throws \Cake\Http\Exception\BadRequestException if the API version provided is deprecated
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        try {
            /** @var \Cake\Http\ServerRequest $request */
            $request->getCookieCollection();
        } catch (InvalidArgumentException $exception) {
            // Remap error to 400
            throw new BadRequestException($exception->getMessage(), null, $exception);
        }

        return $handler->handle($request);
    }
}

View on GitHub (pinned to 31c1bbc10f)