phacility/phabricator · warning · AphrontMalformedRequestException

Your browser did not submit a "%s" cookie with client state

Error message

Your browser did not submit a "%s" cookie with client state information in the request. Check that cookies are enabled. If this problem persists, you may need to clear your cookies.

What it means

Thrown by PhabricatorAuthProvider::getAuthCSRFCode() when the browser submitted no 'phcid' client-state cookie (PhabricatorCookies::COOKIE_CLIENTID). The provider derives the expected OAuth 'state' value from a weak digest of this cookie, so the cookie is mandatory for any CSRF-protected auth handshake. It is raised as an AphrontMalformedRequestException with a user-facing title ('Missing Client ID Cookie') so Phabricator renders a friendly page rather than a raw stack trace.

Source

Thrown at src/applications/auth/provider/PhabricatorAuthProvider.php:549

    return phabricator_form(
      $viewer,
      array(
        'method' => idx($attributes, 'method', 'GET'),
        'action' => (string)$uri,
        'sigil'  => idx($attributes, 'sigil'),
      ),
      $content);
  }

  public function renderConfigurationFooter() {
    return null;
  }

  public function getAuthCSRFCode(AphrontRequest $request) {
    $phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
    if (!strlen($phcid)) {
      throw new AphrontMalformedRequestException(
        pht('Missing Client ID Cookie'),
        pht(
          'Your browser did not submit a "%s" cookie with client state '.
          'information in the request. Check that cookies are enabled. '.
          'If this problem persists, you may need to clear your cookies.',
          PhabricatorCookies::COOKIE_CLIENTID),
        true);
    }

    return PhabricatorHash::weakDigest($phcid);
  }

  protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
    $expect = $this->getAuthCSRFCode($request);

    if (!strlen($actual)) {
      throw new Exception(
        pht(

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Tell the user to enable cookies for the Phabricator origin and retry the login from a fresh tab.
2. Have the user clear existing Phabricator cookies (stale phcid from an old domain can be as bad as none), then reload the login page so a fresh phcid is issued.
3. If Phabricator is iframed, open the auth flow in a top-level window — third-party-cookie blocking prevents phcid from being sent.
4. Verify the site is served from one consistent canonical domain (no mixed www/apex or http/https flips) so the Set-Cookie on phcid actually survives to the callback.

// In a custom provider/controller, check the cookie before starting the flow
if (!strlen($request->getCookie(PhabricatorCookies::COOKIE_CLIENTID))) {
  // render a 'enable cookies' notice instead of beginning the handshake
}

try {
  $code = $provider->getAuthCSRFCode($request);
} catch (AphrontMalformedRequestException $ex) {
  // already user-friendly: re-render the login page with $ex->getTitle()
  // and $ex->getURI()/message; do not retry automatically
}

When it happens

Trigger: Initiating a login/registration handshake (e.g. OAuth provider callback) in a browser where the phcid cookie was never set or was not sent: cookies blocked by browser settings or an extension, third-party-cookie blocking when Phabricator is embedded in an iframe, a browser in private mode with cookies rejected, or cookies cleared between the request that set phcid and the callback.

Common situations: Corporate browsers with strict cookie policies; users in incognito; Safari ITP dropping the cookie; Phabricator loaded inside another product's frame; cookie domain/path mismatches after a hostname change so the cookie never comes back.

Related errors

• The authentication provider did not return a client state pa
• The authentication provider did not return the correct clien
• Two authentication providers use the same provider key ('%s'
• Authentication provider (of class "%s") is attempting to loa
• Username and password are required!

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/f997a30f53a4a057. Report an issue: GitHub.