{"record":{"id":"1ad82cf211eafee7","repo":"RocketChat/Rocket.Chat","slug":"error-password-in-history","errorCode":"error-password-in-history","errorMessage":"Entered password has been previously used","messagePattern":"Entered password has been previously used","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/saveUserProfile.ts","lineNumber":133,"sourceCode":"\t}\n\n\tif (user && settings.email) {\n\t\tawait setEmailFunction(settings.email, user);\n\t}\n\n\tconst canChangePasswordForOAuth = rcSettings.get<boolean>('Accounts_AllowPasswordChangeForOAuthUsers');\n\tif (canChangePasswordForOAuth || user?.services?.password) {\n\t\t// Should be the last check to prevent error when trying to check password for users without password\n\t\tif (settings.newPassword && rcSettings.get<boolean>('Accounts_AllowPasswordChange') === true && user?.services?.password?.bcrypt) {\n\t\t\t// don't let user change to same password\n\t\t\tif (user && (await compareUserPassword(user, { plain: settings.newPassword }))) {\n\t\t\t\tthrow new Meteor.Error('error-password-same-as-current', 'Entered password same as current password', {\n\t\t\t\t\tmethod: 'saveUserProfile',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (user?.services?.passwordHistory && !(await compareUserPasswordHistory(user, { plain: settings.newPassword }))) {\n\t\t\t\tthrow new Meteor.Error('error-password-in-history', 'Entered password has been previously used', {\n\t\t\t\t\tmethod: 'saveUserProfile',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tpasswordPolicy.validate(settings.newPassword);\n\n\t\t\tawait Accounts.setPasswordAsync(this.userId, settings.newPassword, {\n\t\t\t\tlogout: false,\n\t\t\t});\n\n\t\t\tif (user.requirePasswordChange) {\n\t\t\t\tawait Users.unsetRequirePasswordChange(user._id);\n\t\t\t\tunset.requirePasswordChange = true;\n\t\t\t\tunset.requirePasswordChangeReason = true;\n\t\t\t}\n\n\t\t\tawait Users.addPasswordToHistory(\n\t\t\t\tthis.userId,","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/saveUserProfile.ts#L115-L151","documentation":"Password-history enforcement in saveUserProfile: if the user has services.passwordHistory and the new password matches one of the last Accounts_Password_History_Amount stored hashes (compareUserPasswordHistory returned false, meaning a history entry matched), the change is rejected. The feature is governed by Accounts_Password_History_Enabled.","triggerScenarios":"settings.newPassword reuses a password present in user.services.passwordHistory on a workspace where Accounts_Password_History_Enabled=true; the same-password check must pass first, and Accounts_AllowPasswordChange must be true.","commonSituations":"Enterprises enforcing no-reuse policies; users alternating between two favorite passwords; password managers re-suggesting recently used credentials.","solutions":["Ask the user for a password they have not used recently and surface 'This password was used before' on error-password-in-history","Review Accounts_Password_History_Enabled / Accounts_Password_History_Amount if the policy is stricter than intended","In the UI, keep the error next to the new-password field so the user does not assume a typo"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// history is server-side; client can only enforce policy shape:\nif (newPassword && newPassword === currentPassword) {\n  throw new Error('New password must differ from the current password');\n}","typeGuard":null,"tryCatchPattern":"catch (err) {\n  if (err instanceof Meteor.Error && err.error === 'error-password-in-history') {\n    showFieldError('newPassword', 'This password was used before - pick a new one');\n  }\n}","preventionTips":["Tell users explicitly how many recent passwords are blocked (Accounts_Password_History_Amount) so they stop cycling","Do not auto-generate and submit passwords in loops; each retry burns candidate values into user frustration","Pair the catch with a password-manager-friendly error message instead of a generic failure"],"tags":["meteor","password","account","policy"],"backgroundTag":"password-reuse-blocked","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}