SonarSource/sonarqube · error · PasswordException

new_password_same_as_old

new_password_same_as_old

Error message

Password must be different from old password

What it means

checkNewPasswordSameAsOld rejects a change request where the new password equals the previous one, throwing PasswordException with code new_password_same_as_old. This enforces that each change actually rotates the credential.

Solutions

1. Choose a genuinely different new password
2. Fix automation to track whether the change already succeeded and not resend identical values
3. Remove identical-value prefill from client forms

Example fix

// before
POST ...?previous_password=Abc123!&new_password=Abc123!
// after
POST ...?previous_password=Abc123!&new_password=Xyz789#

if (newPassword === previousPassword) throw new Error('New password must differ from the old one');

try { await changePassword(login, oldPw, newPw); } catch (e) { if (e.code === 'new_password_same_as_old') { promptForDifferentPassword(); return; } throw e; }

When it happens

Trigger: POST api/users/change_password where new_password string-equals previous_password.

Common situations: Users re-submitting the same password to 'refresh' it; automation retry loops resending the same pair after a partial success; forms prefilling both fields identically.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• old_password_incorrect
• %s
• The ' ' parameter is missing
• Field ' ' is not sortable
• Provided JSON is invalid

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/852bde78320fa9d4. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java:199

  private static String getParamOrThrow(HttpRequest request, String key) throws PasswordException {
    String value = request.getParameter(key);
    if (isNullOrEmpty(value)) {
      throw new PasswordException(format(MSG_PARAMETER_MISSING, key));
    }
    return value;
  }

  private void checkPreviousPassword(DbSession dbSession, UserDto user, String password) throws PasswordException {
    try {
      localAuthentication.authenticate(dbSession, user, password, AuthenticationEvent.Method.BASIC);
    } catch (AuthenticationException ex) {
      throw new PasswordException(OLD_PASSWORD_INCORRECT, "Incorrect password");
    }
  }

  private static void checkNewPasswordSameAsOld(String newPassword, String previousPassword) throws PasswordException {
    if (previousPassword.equals(newPassword)) {
      throw new PasswordException(NEW_PASSWORD_SAME_AS_OLD, "Password must be different from old password");
    }
  }

  private UserDto getUserOrThrow(DbSession dbSession, String login) {
    UserDto user = dbClient.userDao().selectByLogin(dbSession, login);
    if (user == null || !user.isActive()) {
      throw new NotFoundException(format("User with login '%s' has not been found", login));
    }
    return user;
  }

  private void deleteTokensAndRefreshSession(HttpRequest request, HttpResponse response, DbSession dbSession, UserDto user) {
    dbClient.sessionTokensDao().deleteByUser(dbSession, user);
    refreshJwtToken(request, response, user);
  }

  private void refreshJwtToken(HttpRequest request, HttpResponse response, UserDto user) {
    jwtHttpHandler.removeToken(request, response);

View on GitHub (pinned to 184c821202)