RayWangQvQ/BiliBiliToolPro · error · Exception

Current password is incorrect.

Error message

Current password is incorrect.

What it means

ChangePasswordAsync verifies the supplied currentPassword against the stored salted hash of the admin user via PasswordHelper.VerifyPassword; on mismatch it throws a plain Exception('Current password is incorrect.'). It is an authentication guard preventing password changes without knowing the existing password.

Solutions

1. Re-enter the current password carefully (watch for trailing whitespace or keyboard-layout issues).
2. Use the default initial password on first login if the database was just seeded; change it afterwards.
3. If the password is truly lost, reset the admin row (re-seed or clear PasswordHash/Salt) via the documented recovery procedure or by deleting the data store.
4. Catch this in the UI layer and surface a friendly validation message instead of an unhandled exception.

Example fix

// before
try { await authService.ChangePasswordAsync(current, next); }
catch { throw; }
// after
try { await authService.ChangePasswordAsync(current, next); }
catch (Exception ex) when (ex.Message == "Current password is incorrect.")
{
    message = "当前密码不正确";
    return;
}

// client-side pre-check before submit
if (string.IsNullOrWhiteSpace(currentPassword) || string.IsNullOrWhiteSpace(newPassword))
{
    message = "请填写当前密码和新密码";
    return;
}

try { await authService.ChangePasswordAsync(current, next); message = "密码修改成功"; }
catch (Exception ex) when (ex.Message.Contains("password is incorrect"))
{
    message = "当前密码不正确，请重试";
}

When it happens

Trigger: Submitting the change-password form with a current password that doesn't match the stored hash — wrong password typed, wrong user record (no admin seeded correctly), or the password hash/salt columns altered or migrated incorrectly.

Common situations: User forgot the previously set admin password; fresh deployment where the default password differs from what the user enters; database reset replaced the hash but the user retries an old password; copy/paste whitespace in the password field.

AI-assisted analysis of RayWangQvQ/BiliBiliToolPro@c599b2c0da (2026-09-12). Data as JSON: /api/errors/d11ed7c00ed14a39. Report an issue: GitHub.

Appendix: source

Thrown at src/Ray.BiliBiliTool.Web/Services/AuthService.cs:47

            );

            return claimsIdentity;
        }

        return new ClaimsIdentity();
    }

    public async Task ChangePasswordAsync(
        string username,
        string currentPassword,
        string newPassword
    )
    {
        var user = await userRepository.GetAdminAsync();

        if (!PasswordHelper.VerifyPassword(currentPassword, user.Salt, user.PasswordHash))
        {
            throw new Exception("Current password is incorrect.");
        }

        var (hash, salt) = PasswordHelper.HashPassword(newPassword);

        user.Salt = salt;
        user.PasswordHash = hash;
        user.Username = username;

        await userRepository.UpdateAsync(user);
    }

    public async Task<string> GetAdminUserNameAsync()
    {
        var user = await userRepository.GetAdminAsync();
        return user.Username;
    }
}

View on GitHub (pinned to c599b2c0da)