AlistGo/alist · warning · EmptyPassword

password is empty

Error message

password is empty

What it means

EmptyPassword is a sentinel in internal/errs/user.go raised when a request that requires a password supplies an empty one. Login validation rejects it immediately (an empty password can never match the stored hash), and user creation/update requires a non-empty password.

Source

Thrown at internal/errs/user.go:7

package errs

import "errors"

var (
	EmptyUsername      = errors.New("username is empty")
	EmptyPassword      = errors.New("password is empty")
	WrongPassword      = errors.New("password is incorrect")
	DeleteAdminOrGuest = errors.New("cannot delete admin or guest")
)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Supply the actual password in the 'password' field of the request
2. Verify environment variables holding credentials are set and non-empty in automation
3. Add a client-side non-empty check before calling login or user APIs
4. If creating a user, generate and pass an initial password

// client-side guard before login/user APIs
if strings.TrimSpace(password) == "" {
    return errs.EmptyPassword
}

func hasPassword(s string) bool { return strings.TrimSpace(s) != "" }

if err := login(user, pass); err != nil {
    if errors.Is(err, errs.EmptyPassword) { /* prompt for password */ }
}

When it happens

Trigger: Login request with an empty or missing password field; admin API creating/updating a user without a password; password hash generation attempted on an empty string.

Common situations: Login forms submitted before the password field is filled; scripts/CI credentials with an unset environment variable producing an empty password; password managers failing to autofill; JSON key typos like 'pass' instead of 'password'.

Related errors

• username is empty
• SafePassword is incorrect
• api_key is empty
• cookie is empty
• empty token

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/4a7e331e3d0c1396. Report an issue: GitHub.