HeyPuter/puter · warning · HttpError

password_mismatch

password_mismatch

Error message

Password mismatch

What it means

Raised when `bcrypt.compare(bodyPassword, user.password)` returns false (or throws, which is treated as false). The submitted password does not match the account's stored hash — a wrong password, not an auth failure.

Source

Thrown at src/backend/core/http/middleware/userProtected.ts:236

                    oidcService,
                    user,
                );
                throw new HttpError(403, 'OIDC revalidation required', {
                    legacyCode: 'oidc_revalidation_required',
                    fields,
                });
            }
            let match = false;
            try {
                match = await bcrypt.compare(
                    bodyPassword,
                    String(user.password),
                );
            } catch {
                match = false;
            }
            if (!match)
                throw new HttpError(400, 'Password mismatch', {
                    legacyCode: 'password_mismatch',
                });
            return next();
        }

        const cookieValue = req.cookies?.[REVALIDATION_COOKIE_NAME];
        if (cookieValue) {
            try {
                const payload = tokenService.verify<RevalidationPayload>(
                    'oidc-state',
                    cookieValue,
                );
                if (
                    payload?.purpose === 'revalidate' &&
                    payload.user_uuid === user.uuid
                ) {
                    return next();
                }

View on GitHub (pinned to 908ec23eda)

Solutions

  1. Re-enter the correct current password.
  2. If forgotten, use the password-reset flow instead of retrying blindly.
  3. In the GUI, re-surface the password prompt on this 400.
Defensive patterns

Strategy: validation

Validate before calling

// Basic non-empty check before posting:
if (!body.password || !body.password.trim()) { showPasswordError(); return; }

Try / catch

try { await call(body); }
catch (e) {
  if (e.code === 'password_mismatch') { rePromptPassword(); return; }
  throw e;
}

Prevention

When it happens

Trigger: Submitting an incorrect password in the body of a userProtected route (delete account, change password, etc.).

Common situations: Typo; caps lock; an old/forgotten password; password changed elsewhere since last entry.

Related errors

AI-assisted analysis of HeyPuter/puter@908ec23eda (2026-08-12). Data as JSON: /api/errors/874ddef9db0fe4ae. Report an issue: GitHub.