{"record":{"id":"2e9ce8a14cab9c43","repo":"mattermost-community/focalboard","slug":"invalid-password","errorCode":null,"errorMessage":"Invalid password","messagePattern":"Invalid password","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"server/app/auth.go","lineNumber":178,"sourceCode":"\tif user == nil && email != \"\" {\n\t\tvar err error\n\t\tuser, err = a.store.GetUserByEmail(email)\n\t\tif err != nil && !model.IsErrNotFound(err) {\n\t\t\treturn err\n\t\t}\n\t\tif user != nil {\n\t\t\treturn errors.New(\"The email already exists\")\n\t\t}\n\t}\n\n\t// TODO: Move this into the config\n\tpasswordSettings := auth.PasswordSettings{\n\t\tMinimumLength: 6,\n\t}\n\n\terr := auth.IsPasswordValid(password, passwordSettings)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"Invalid password\")\n\t}\n\n\t_, err = a.store.CreateUser(&model.User{\n\t\tID:          utils.NewID(utils.IDTypeUser),\n\t\tUsername:    username,\n\t\tEmail:       email,\n\t\tPassword:    auth.HashPassword(password),\n\t\tMfaSecret:   \"\",\n\t\tAuthService: a.config.AuthMode,\n\t\tAuthData:    \"\",\n\t})\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"Unable to create the new user\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/mattermost-community/focalboard/blob/a84bbb65e32edf972856b329417096ac413518e9/server/app/auth.go#L160-L196","documentation":"RegisterUser wraps a validation failure from auth.IsPasswordValid as 'Invalid password'. Before creating a user, the supplied password is checked against PasswordSettings (here MinimumLength: 6); a password shorter than the minimum (or otherwise invalid) aborts registration. The wrapped cause contains the specific rule violated.","triggerScenarios":"App.RegisterUser(username, email, password) called with a password shorter than 6 characters (or failing any other IsPasswordValid rule), with unique username/email already verified.","commonSituations":"Signup form with missing/weak client-side validation; empty password field; API client bypassing the UI; password with leading/trailing whitespace mishandled; requirements changed between client and server versions.","solutions":["Enforce the minimum length (6) client-side before calling RegisterUser","Read errors.Cause(err) to show the user the exact rule violated","Trim/handle whitespace and empty passwords in the input form","Keep client-side password policy in sync with server PasswordSettings"],"exampleFix":"// before\npassword := r.FormValue(\"password\")\nerr := app.RegisterUser(username, email, password)\n// after\npassword := strings.TrimSpace(r.FormValue(\"password\"))\nif len(password) < 6 {\n    return errors.New(\"password must be at least 6 characters\")\n}\nerr := app.RegisterUser(username, email, password)","handlingStrategy":"validation","validationCode":"const minPasswordLength = 6\nfunc passwordOK(p string) bool {\n    return len(strings.TrimSpace(p)) >= minPasswordLength\n}\n// call before RegisterUser:\nif !passwordOK(password) {\n    return errors.New(\"password must be at least 6 characters\")\n}","typeGuard":"func isPasswordInvalidErr(err error) bool {\n    return strings.Contains(err.Error(), \"Invalid password\")\n}","tryCatchPattern":"if err := app.RegisterUser(username, email, password); err != nil {\n    if strings.Contains(err.Error(), \"Invalid password\") {\n        return fmt.Errorf(\"password rejected: %v\", errors.Cause(err))\n    }\n    return err\n}","preventionTips":["Mirror the server's MinimumLength (6) rule in client-side forms","Trim and require non-empty passwords before submission","Surface errors.Cause(err) to the user as a specific rule message","Keep client and server password policies in sync when settings change"],"tags":["validation","password","registration"],"backgroundTag":"password-validation-failed","analyzedSha":"a84bbb65e32edf972856b329417096ac413518e9","analyzedAt":"2026-08-30T09:22:20.720Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}