{"record":{"id":"58f50400b268e77d","repo":"fullstackhero/dotnet-starter-kit","slug":"passwords-do-not-match","errorCode":null,"errorMessage":"Passwords do not match.","messagePattern":"Passwords do not match\\.","errorType":"exception","errorClass":"CustomException","httpStatus":400,"severity":"error","filePath":"src/Modules/Identity/Modules.Identity/Services/UserRegistrationService.cs","lineNumber":233,"sourceCode":"            ?? email.Split('@')[0];\n\n        return (firstName, lastName, userName);\n    }\n\n    private async Task<string> EnsureUniqueUserNameAsync(string userName)\n    {\n        if (await userManager.FindByNameAsync(userName) is not null)\n        {\n            return $\"{userName}_{Guid.NewGuid():N}\"[..20];\n        }\n        return userName;\n    }\n\n    private static void ValidatePasswordMatch(string password, string confirmPassword)\n    {\n        if (password != confirmPassword)\n        {\n            throw new CustomException(\n                \"Passwords do not match.\",\n                errors: null,\n                HttpStatusCode.BadRequest);\n        }\n    }\n\n    private async Task<FshUser> CreateUserWithPasswordAsync(\n        string firstName,\n        string lastName,\n        string email,\n        string userName,\n        string password,\n        string phoneNumber)\n    {\n        var user = new FshUser\n        {\n            Email = email,\n            FirstName = firstName,","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/fullstackhero/dotnet-starter-kit/blob/3f2959e683e9f83f13e55e1678c9119f63c7e8e5/src/Modules/Identity/Modules.Identity/Services/UserRegistrationService.cs#L215-L251","documentation":"Thrown as a CustomException (400) by the static ValidatePasswordMatch helper, called from RegisterAsync, when the password and confirmPassword fields differ. A pure pre-persistence check so Identity never sees mismatched passwords; the fix is always on the caller's side. Note the comparison is ordinal/exact — whitespace and case matter.","triggerScenarios":"Registration request whose password and confirmPassword JSON properties differ; frontend forgot to bind the confirm field; client sending only one of the two fields (confirm defaults to null/empty).","commonSituations":"User typos in the confirm box or has Caps Lock on; autocomplete fills only the first field; API consumers (Postman/scripts) omit confirmPassword; leading/trailing spaces from copy-paste.","solutions":["Compare the two values client-side before submitting and show a field-level error","Ensure the request serializer maps confirmPassword explicitly (no missing/renamed property)","Trim client inputs consistently if your policy allows, or enforce no-whitespace passwords","Use a show-password toggle so users can verify the typed password"],"exampleFix":"// before\nif (password !== confirmPasswordField.value.trim()) return; // silent skip\n// after\nif (password !== confirmPassword) {\n  setError('confirmPassword', { message: 'Passwords do not match.' });\n  return;\n}\nawait register({ password, confirmPassword });","handlingStrategy":"validation","validationCode":"function validate(password: string, confirmPassword: string): string | null { return password === confirmPassword ? null : 'Passwords do not match.'; }","typeGuard":"bool PasswordsMatch(RegisterRequest r) => r is not null && !string.IsNullOrEmpty(r.Password) && r.Password == r.ConfirmPassword;","tryCatchPattern":"catch (CustomException ex) when (ex.Message == \"Passwords do not match.\") { return Results.BadRequest(new { field = \"confirmPassword\", message = ex.Message }); }","preventionTips":["Validate equality client-side before the request","Make confirmPassword required in the request DTO/schema so it can't silently default to null","Disable the submit button until both fields match","Warn about Caps Lock in the password fields"],"tags":["validation","registration","passwords"],"backgroundTag":"invalid-argument-value","analyzedSha":"3f2959e683e9f83f13e55e1678c9119f63c7e8e5","analyzedAt":"2026-09-15T22:20:53.684Z","contentChangedAt":"2026-09-15T22:20:53.684Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}