{"record":{"id":"107bd1f523608de9","repo":"HeyPuter/puter","slug":"password-required-107bd1","errorCode":"password_required","errorMessage":"Password required","messagePattern":"Password required","errorType":"exception","errorClass":"HttpError","httpStatus":403,"severity":"error","filePath":"src/backend/core/http/middleware/userProtected.ts","lineNumber":271,"sourceCode":"                    return next();\n                }\n            } catch {\n                // Fall through to the no-credentials branch.\n            }\n        }\n\n        if (user.password === null) {\n            const fields = await buildRevalidateFields(\n                config,\n                oidcService,\n                user,\n            );\n            throw new HttpError(403, 'OIDC revalidation required', {\n                legacyCode: 'oidc_revalidation_required',\n                fields,\n            });\n        }\n        throw new HttpError(403, 'Password required', {\n            legacyCode: 'password_required',\n        });\n    };\n\n    return [requireSessionCookie, refreshUser, verifyIdentity];\n};\n","sourceCodeStart":253,"sourceCodeEnd":278,"githubUrl":"https://github.com/HeyPuter/puter/blob/908ec23eda38526170322c3edf71ba45ecb1ca95/src/backend/core/http/middleware/userProtected.ts#L253-L278","documentation":"Raised when the account has a password (password account, not OIDC) but the request supplied neither a `password` in the body nor a valid `puter_revalidation` cookie. The userProtected gate requires an explicit identity reconfirmation for sensitive actions.","triggerScenarios":"A password-based account calls a userProtected route without including the `password` field and without a valid revalidation cookie.","commonSituations":"The GUI forgot to prompt for the password; the request body omitted the field; the revalidation cookie expired so neither credential is present.","solutions":["Include the current `password` in the request body.","Or provide a valid puter_revalidation cookie (re-issue it via the revalidation flow).","Ensure the GUI prompts for password confirmation on sensitive actions."],"exampleFix":"// before\nfetch('/user', { method:'DELETE', credentials:'include' });\n// after\nfetch('/user', {\n  method:'DELETE',\n  credentials:'include',\n  body: JSON.stringify({ password: currentPassword }),\n});","handlingStrategy":"validation","validationCode":"// Require a password client-side for password accounts:\nif (user.password != null && !body.password) { promptPassword(); return; }","typeGuard":"const isPasswordAccount = (u) => !!(u && u.password != null);","tryCatchPattern":"try { await call(body); }\ncatch (e) {\n  if (e.code === 'password_required') { promptPassword(); return; }\n  throw e;\n}","preventionTips":["Always prompt for the current password on sensitive actions for password accounts.","Include the password field in the request body.","Provide a valid puter_revalidation cookie as an alternative."],"tags":["password","auth","user-protected","reconfirmation"],"backgroundTag":null,"analyzedSha":"908ec23eda38526170322c3edf71ba45ecb1ca95","analyzedAt":"2026-08-12T20:53:15.911Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}