What causes "That phrase didn't work. Try again." in Freika/dawarich?

Re-enter the phrase exactly as shared — it is case-sensitive and not trimmed server-side

That phrase didn't work. Try again.

Error message

That phrase didn't work. Try again.

What it means

This is a user-facing flash message, not a log: when someone submits the wrong magic phrase on a shared link's unlock screen, ActiveSupport::SecurityUtils.secure_compare against @link.magic_phrase fails, Rails logs 'Shared link unlock failed' with the link id and requester IP, and the phrase prompt re-renders with HTTP 401. It is the expected incorrect-credentials path for Dawarich's shared-link protection; the constant-time compare prevents phrase-guessing timing attacks.

Source

Thrown at app/controllers/shared/links_controller.rb:23

  skip_before_action :verify_authenticity_token, only: %i[show unlock]
  before_action :set_noindex
  before_action :load_link
  before_action :verify_phrase, only: :show

  def show
    @link.touch_access!
    @resource = @link.resource
    render :show
  end

  def unlock
    if ActiveSupport::SecurityUtils.secure_compare(@link.magic_phrase.to_s, params[:phrase].to_s)
      set_unlock_cookie
      redirect_to public_shared_link_path(@link.id)
    else
      Rails.logger.warn("Shared link unlock failed: link=#{@link.id} ip=#{request.remote_ip}")
      flash.now[:error] = I18n.t('controllers.shared.links.incorrect_phrase')
      render :phrase_prompt, status: :unauthorized
    end
  end

  private

  def load_link
    @link = SharedLink.active.find_by(id: params[:id])
    return if @link

    render 'shared/links/not_found', status: :not_found, layout: 'shared'
  end

  def verify_phrase
    return if @link.magic_phrase.blank?
    return if cookies.encrypted[unlock_cookie_key] == @link.unlock_token

    render :phrase_prompt, status: :unauthorized

View on GitHub (pinned to 97fad417c5)

Solutions

Re-enter the phrase exactly as shared — it is case-sensitive and not trimmed server-side
If you own the link, open its settings, confirm the current magic phrase, and re-share it
Check the Rails warn line for attempt volume and IPs if you suspect guessing
Rotate the phrase or deactivate the link if unlock attempts look hostile

Example fix

<!-- before: browser autofill/copy-paste can submit trailing spaces -->
<input type="text" name="phrase" id="phrase">
<!-- after: trim on the client; server still compares exactly -->
<input type="text" name="phrase" id="phrase" autocomplete="off"
       oninput="this.value = this.value.trim()">

Defensive patterns

Strategy: validation

Validate before calling

const phrase = phraseInput.value
if (phrase.trim().length === 0) {
  showError("Enter the phrase")
  return false
}
submitForm(phrase.trim()) // sender-side trim; the server still compares exactly

Prevention

Trim input on the client before submit; the server compares byte-for-byte
Share phrases via copyable text, not screenshots — case matters
Rate-limit unlock attempts at the proxy/Rack layer to blunt phrase guessing
Rotate the magic phrase if 'Shared link unlock failed' log lines spike

When it happens

Trigger: A typo'd or wrong-case phrase (the compare is exact and case-sensitive); the link owner rotated the magic phrase after the URL was shared; trailing whitespace or autocomplete mangling the submitted input; brute-force attempts against a discovered link id.

Common situations: Recipients copy-pasting a phrase with a stray space or smart quote from a messaging app; owners regenerating the phrase and forgetting to re-share it; publicly posted links attracting guessing attempts visible as 'Shared link unlock failed' log lines.

Related errors

AI-assisted analysis of Freika/dawarich@97fad417c5 (2026-08-21). Data as JSON: /api/errors/e36c1611d4637452. Report an issue: GitHub.