passbolt/passbolt_api · warning · BadRequestException

The email is required in URL parameters.

Error message

The email is required in URL parameters.

What it means

Thrown by the SSO recover error-handling controller when the 'email' query parameter is absent, not a string, or fails email format validation. Passbolt requires the URL to identify the recovering account via a valid email so it can render the appropriate error screen.

Solutions

1. Append a syntactically valid email query parameter to the URL, e.g. ?email=user%40example.com
2. Check the SSO/IdP redirect template that builds the recover URL and include the email parameter URL-encoded
3. Verify no reverse proxy or rewrite rule strips query parameters
4. If the email is genuinely unknown, start the recover flow again from the login/recover page

Example fix

// before
GET /sso/recover/error?email=
// after
GET /sso/recover/error?email=user%40example.com

const email = new URLSearchParams(window.location.search).get('email');
if (typeof email === 'string' && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
  window.location.href = '/sso/recover/error?email=' + encodeURIComponent(email);
}

function isNonEmptyEmail(v) { return typeof v === 'string' && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v); }

When it happens

Trigger: Hitting GET /sso-recover/error (or similar) without ?email=, with an empty email=, or with a malformed value like email=not-an-email.

Common situations: Users/bookmarks saved with a truncated SSO recover URL; custom identity-provider redirect templates omitting the email query parameter; proxies rewriting or stripping the query string; users typing the error URL manually.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• Ajax/Json request not supported.
• Ajax/Json request not supported.
• Ajax/Json request not supported.
• Ajax/Json request not supported.
• Ajax/Json request not supported.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/5df8137ccb6f6762. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/SelfRegistration/HandleErrorController.php:50

        parent::beforeFilter($event);

        $this->Authentication->allowUnauthenticated(['handleError']);
    }

    /**
     * @return void
     */
    public function handleError(): void
    {
        if ($this->request->is('json')) {
            throw new BadRequestException(__('Ajax/Json request not supported.'));
        }

        $this->User->assertNotLoggedIn();

        $email = $this->request->getQuery('email');
        if (!is_string($email) || !EmailValidationRule::check($email)) {
            throw new BadRequestException(__('The email is required in URL parameters.'));
        }

        $this->set(['message' => __('The user does not exist.')]);

        $this
            ->viewBuilder()
            ->setLayout('default')
            ->setTemplatePath('SelfRegistration')
            ->setTemplate('handle_error');
    }
}

View on GitHub (pinned to 31c1bbc10f)