{"record":{"id":"45caf8bf14bd8ef7","repo":"apolloconfig/apollo","slug":"passwords-cannot-be-consecutive-regular-letters-o","errorCode":null,"errorMessage":"Passwords cannot be consecutive, regular letters or numbers. And cannot be commonly used. e.g: abcd1234, 1234qwer, 1q2w3e4r, 1234asdfghjk, ...","messagePattern":"Passwords cannot be consecutive, regular letters or numbers\\. And cannot be commonly used\\. e\\.g: abcd1234, 1234qwer, 1q2w3e4r, 1234asdfghjk, \\.\\.\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java","lineNumber":83,"sourceCode":"  }\n\n  @PostMapping(\"/users\")\n  public void createOrUpdateUser(\n      @RequestParam(value = \"isCreate\", defaultValue = \"false\") boolean isCreate,\n      @RequestBody UserPO user) {\n    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {\n      throw new BadRequestException(\"Username and password can not be empty.\");\n    }\n\n    if (!unifiedPermissionValidator.isSuperAdmin()\n        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())\n            || user.getEnabled() != USER_ENABLED)) {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n\n    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());\n    if (!pwdCheckRes.isSuccess()) {\n      throw new BadRequestException(pwdCheckRes.getMessage());\n    }\n\n    if (userService instanceof SpringSecurityUserService) {\n      if (isCreate) {\n        ((SpringSecurityUserService) userService).create(user);\n      } else {\n        ((SpringSecurityUserService) userService).update(user);\n      }\n    } else {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n  }\n\n  @PreAuthorize(value = \"@unifiedPermissionValidator.isSuperAdmin()\")\n  @PutMapping(\"/users/enabled\")\n  public void changeUserEnabled(@RequestBody UserPO user) {\n    if (userService instanceof SpringSecurityUserService) {\n      ((SpringSecurityUserService) userService).changeEnabled(user);","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java#L65-L101","documentation":"Surfaced via UserInfoController.createOrUpdateUser from AuthUserPasswordChecker.checkWeakPassword when the password passes the length/charset regex but is flagged as commonly-used: it contains (case-insensitive) a substring listed in portalConfig.getUserPasswordNotAllowList(). Returned as BadRequestException (HTTP 400).","triggerScenarios":"POST /users with a password such as abcd1234, 1234qwer, 1q2w3e4r — any value whose lowercase form contains an entry from the configured not-allow list.","commonSituations":"Operator uses a well-known weak password; the not-allow list (portal config) was extended to block patterns present in an existing user's chosen password; CI seeded users with a predictable default password.","solutions":["Pick a non-dictionary, non-sequential password that contains none of the blocked substrings.","Review portalConfig.getUserPasswordNotAllowList() (the blocked-fragments list) to learn which patterns are rejected.","Regenerate programmatically with a strong random generator and verify it is not on the blocklist."],"exampleFix":"// before\nString pwd = \"abcd1234\"; // blocked\n\n// after\nString pwd = randomAlnum(16); // verify none of portalConfig.getUserPasswordNotAllowList() is a substring\nboolean blocked = notAllowList.stream().anyMatch(pwd.toLowerCase()::contains);\nif (blocked) { pwd = regenerate(); }","handlingStrategy":"validation","validationCode":"List<String> blocked = portalConfig.getUserPasswordNotAllowList();\nString lower = password.toLowerCase();\nif (blocked != null && blocked.stream().anyMatch(lower::contains)) {\n  return ResponseEntity.badRequest().body(\"password is on the commonly-used blocklist\");\n}","typeGuard":"boolean isWeakPassword(String p, List<String> blocklist) {\n  String l = p == null ? \"\" : p.toLowerCase();\n  return blocklist != null && blocklist.stream().anyMatch(l::contains);\n}","tryCatchPattern":null,"preventionTips":["Avoid dictionary/sequential passwords (abcd1234, 1234qwer).","Mirror the portal's not-allow list in your password generator.","Use a strong random generator for service accounts."],"tags":["apollo-portal","password-policy","weak-password","validation"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}