{"record":{"id":"04be860209f17ca6","repo":"alibaba/nacos","slug":"user-username-not-exist","errorCode":null,"errorMessage":"user  + username +  not exist!","messagePattern":"user  \\+ username \\+  not exist!","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/controller/v3/UserControllerV3.java","lineNumber":208,"sourceCode":"    public Result<String> updateUser(@RequestParam String username,\n        @RequestParam String newPassword,\n        HttpServletResponse response, HttpServletRequest request) throws IOException {\n        try {\n            if (!hasPermission(username, request)) {\n                response.sendError(HttpServletResponse.SC_FORBIDDEN, \"authorization failed!\");\n                return null;\n            }\n        } catch (HttpSessionRequiredException e) {\n            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"session expired!\");\n            return null;\n        } catch (AccessException exception) {\n            response.sendError(HttpServletResponse.SC_FORBIDDEN, \"authorization failed!\");\n            return null;\n        }\n        \n        User user = userDetailsService.getUser(username);\n        if (user == null) {\n            throw new IllegalArgumentException(\"user \" + username + \" not exist!\");\n        }\n        \n        userDetailsService.updateUserPassword(username, newPassword);\n        return Result.success(\"update user ok!\");\n        \n    }\n    \n    private boolean hasPermission(String username, HttpServletRequest request)\n        throws HttpSessionRequiredException, AccessException {\n        if (!NacosAuthConfigHolder.getInstance().isAnyAuthEnabled()) {\n            return true;\n        }\n        // Fixes #13959. If the user is server identity, should not check permission.\n        if (isFromServerIdentity(request)) {\n            return true;\n        }\n        IdentityContext identityContext =\n            RequestContextHolder.getContext().getAuthContext().getIdentityContext();","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/controller/v3/UserControllerV3.java#L190-L226","documentation":"Thrown by UserControllerV3.updateUserPassword as IllegalArgumentException when the target username does not resolve to a stored User. The update-password endpoint fetches the user and rejects the operation if it is absent.","triggerScenarios":"PUT/PATCH to update a user's password for a username that does not exist (typo, already deleted, or wrong namespace scope).","commonSituations":"Renaming then updating the old name; operating on a user deleted by another admin; case-sensitivity or whitespace mismatches in the username.","solutions":["Verify the username exists via getUser before issuing the update.","Trim and normalize the username to avoid whitespace/case mismatch.","Handle the IllegalArgumentException by surfacing a 404 to the caller rather than a 500."],"exampleFix":"// before\nuserDetailsService.updateUserPassword(username, newPassword); // throws if absent\n\n// after\nif (userDetailsService.getUser(username) == null) {\n    return Result.failure(\"user not exist\");\n}\nuserDetailsService.updateUserPassword(username, newPassword);","handlingStrategy":"validation","validationCode":"if (userDetailsService.getUser(username) == null) {\n    return Result.failure(\"user not exist\");\n}\nuserDetailsService.updateUserPassword(username, newPassword);","typeGuard":"boolean userExists(NacosUserService s, String u) { return s.getUser(u) != null; }","tryCatchPattern":"try {\n    userDetailsService.updateUserPassword(username, newPassword);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"not exist\")) return notFound();\n    throw e;\n}","preventionTips":["Check user existence before password update.","Normalize/trim usernames to avoid case/whitespace mismatch.","Return 404 for missing users instead of 500."],"tags":["auth","user","not-found","illegal-argument"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}