{"record":{"id":"18491a258385d3eb","repo":"apolloconfig/apollo","slug":"password-needs-a-number-and-letter-and-between-8-2","errorCode":null,"errorMessage":"Password needs a number and letter and between 8~20 characters","messagePattern":"Password needs a number and letter and between 8~20 characters","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java","lineNumber":83,"sourceCode":"  }\n\n  @PostMapping(\"/users\")\n  public void createOrUpdateUser(\n      @RequestParam(value = \"isCreate\", defaultValue = \"false\") boolean isCreate,\n      @RequestBody UserPO user) {\n    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {\n      throw new BadRequestException(\"Username and password can not be empty.\");\n    }\n\n    if (!unifiedPermissionValidator.isSuperAdmin()\n        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())\n            || user.getEnabled() != USER_ENABLED)) {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n\n    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());\n    if (!pwdCheckRes.isSuccess()) {\n      throw new BadRequestException(pwdCheckRes.getMessage());\n    }\n\n    if (userService instanceof SpringSecurityUserService) {\n      if (isCreate) {\n        ((SpringSecurityUserService) userService).create(user);\n      } else {\n        ((SpringSecurityUserService) userService).update(user);\n      }\n    } else {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n  }\n\n  @PreAuthorize(value = \"@unifiedPermissionValidator.isSuperAdmin()\")\n  @PutMapping(\"/users/enabled\")\n  public void changeUserEnabled(@RequestBody UserPO user) {\n    if (userService instanceof SpringSecurityUserService) {\n      ((SpringSecurityUserService) userService).changeEnabled(user);","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java#L65-L101","documentation":"Surfaced via UserInfoController.createOrUpdateUser from AuthUserPasswordChecker.checkWeakPassword. The password fails the regex ^(?=.*[0-9].*)(?=.*[a-zA-Z].*).{8,20}$, meaning it lacks a digit, lacks a letter, or is not 8-20 characters long. Returned as BadRequestException (HTTP 400).","triggerScenarios":"POST /users (create or update) with a password that is all-letters, all-digits, shorter than 8, or longer than 20 characters.","commonSituations":"User picks a simple password; automated provisioning uses a numeric-only token; password generator emits a >20 char string that exceeds the cap; legacy password migrated without meeting the policy.","solutions":["Choose a password containing at least one letter and one digit, length 8-20.","If generating passwords programmatically, enforce the same regex before submission.","Communicate the policy to end users in the UI before they submit."],"exampleFix":"// before\nString pwd = \"password\"; // no digit\n\n// after\nString pwd = generatedPassword(); // ensure matches ^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$\nif (!pwd.matches(\"^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$\")) {\n  throw new IllegalArgumentException(\"weak password\");\n}","handlingStrategy":"validation","validationCode":"private static final Pattern PWD = Pattern.compile(\"^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$\");\nif (!PWD.matcher(password).matches()) {\n  return ResponseEntity.badRequest().body(\"password must be 8-20 chars with a letter and a digit\");\n}","typeGuard":"boolean meetsPasswordPolicy(String p) { return p != null && p.matches(\"^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$\"); }","tryCatchPattern":null,"preventionTips":["Enforce the 8-20 char + letter + digit rule client-side.","When generating passwords, apply the same regex before submission."],"tags":["apollo-portal","password-policy","validation","user-management"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}