HeyPuter/puter · error · HttpError

password_required

password_required

Error message

Password required

What it means

Raised when the account has a password (password account, not OIDC) but the request supplied neither a `password` in the body nor a valid `puter_revalidation` cookie. The userProtected gate requires an explicit identity reconfirmation for sensitive actions.

Source

Thrown at src/backend/core/http/middleware/userProtected.ts:271

                    return next();
                }
            } catch {
                // Fall through to the no-credentials branch.
            }
        }

        if (user.password === null) {
            const fields = await buildRevalidateFields(
                config,
                oidcService,
                user,
            );
            throw new HttpError(403, 'OIDC revalidation required', {
                legacyCode: 'oidc_revalidation_required',
                fields,
            });
        }
        throw new HttpError(403, 'Password required', {
            legacyCode: 'password_required',
        });
    };

    return [requireSessionCookie, refreshUser, verifyIdentity];
};

View on GitHub (pinned to 908ec23eda)

Solutions

1. Include the current `password` in the request body.
2. Or provide a valid puter_revalidation cookie (re-issue it via the revalidation flow).
3. Ensure the GUI prompts for password confirmation on sensitive actions.

Example fix

// before
fetch('/user', { method:'DELETE', credentials:'include' });
// after
fetch('/user', {
  method:'DELETE',
  credentials:'include',
  body: JSON.stringify({ password: currentPassword }),
});

// Require a password client-side for password accounts:
if (user.password != null && !body.password) { promptPassword(); return; }

const isPasswordAccount = (u) => !!(u && u.password != null);

try { await call(body); }
catch (e) {
  if (e.code === 'password_required') { promptPassword(); return; }
  throw e;
}

When it happens

Trigger: A password-based account calls a userProtected route without including the `password` field and without a valid revalidation cookie.

Common situations: The GUI forgot to prompt for the password; the request body omitted the field; the revalidation cookie expired so neither credential is present.

Related errors

• password_mismatch
• password_required
• unauthorized
• password_mismatch
• unauthorized

AI-assisted analysis of HeyPuter/puter@908ec23eda (2026-08-12). Data as JSON: /api/errors/107bd1f523608de9. Report an issue: GitHub.