phacility/phabricator · error · AphrontMalformedRequestException

Invalid Request (CSRF)

Error message

Invalid Request (CSRF)

What it means

Thrown by 'bin/repository thaw' when repository arguments were given but the loader resolved zero repositories for them. In practice this branch is nearly unreachable because loadRepositories() throws 'Repository "%s" does not exist!' for any identifier it cannot resolve; it exists as a defensive backstop for the case where the wildcard argument list yields a non-empty argument array that still maps to no repositories (for example degenerate/empty-string arguments surviving the parser).

Source

Thrown at src/aphront/AphrontRequest.php:403

          "this only for writes which can not be protected with normal CSRF ".
          "mechanisms.\n\n".
          "Some UI elements (like %s) also have methods which will allow you ".
          "to render links as forms (like %s).",
          'phabricator_form()',
          'phabricator_form()',
          '/',
          'AphrontWriteGuard::beginScopedUnguardedWrites()',
          'PhabricatorActionListView',
          'setRenderAsForm(true)');
      }

      $message = implode("\n", $info);

      // This should only be able to happen if you load a form, pull your
      // internet for 6 hours, and then reconnect and immediately submit,
      // but give the user some indication of what happened since the workflow
      // is incredibly confusing otherwise.
      throw new AphrontMalformedRequestException(
        pht('Invalid Request (CSRF)'),
        $message,
        true);
    }

    return true;
  }

  public function isFormPost() {
    $post = $this->getExists(self::TYPE_FORM) &&
            !$this->getExists(self::TYPE_HISEC) &&
            $this->isHTTPPost();

    if (!$post) {
      return false;
    }

    return $this->validateCSRF();

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Verify the repository identifiers with 'bin/repository list R...' or the UI before running thaw.
2. Make wrapper scripts fail early when the computed repository list is empty instead of invoking thaw with placeholders.
3. Re-run with explicit, known-good monikers such as 'R123' or a callsign.

Example fix

# before (REPOS expands to a degenerate token)
bin/repository thaw --demote dev-1 $REPOS

# after (guard in the wrapper script)
test -n "$REPOS" || { echo 'no repositories selected' >&2; exit 1; }
bin/repository thaw --demote dev-1 $REPOS

# Verify identifiers resolve before thaw:
for r in $REPOS; do
  bin/repository list "$r" >/dev/null || exit 1
done

When it happens

Trigger: Passing argument tokens that the parser records as a truthy list but that resolve to no repository objects, e.g. 'bin/repository thaw --demote dev-1 ""' in parser edge cases; $repository_names is truthy, loadRepositories() returns an empty array without throwing, and the 'if (!$repositories)' guard at PhabricatorRepositoryManagementThawWorkflow.php:130 fires.

Common situations: Wrapper scripts passing an unquoted empty variable that still expands to a token; automation building the repo list from a query that returned nothing and passing a placeholder instead of failing earlier.

Related errors

• Request parameter "%s" is not formatted properly. Expected a
• Request parameter "%s" is not formatted properly. Expected a
• This server is configured as "%s", but you are using the dom
• Received "multipart/form-data" request with no "boundary".
• Expected "multipart/form-data" parse to end in state "epilog

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/4b8302a18d329288. Report an issue: GitHub.