{"record":{"id":"76bdffe7c7460d0a","repo":"SigNoz/signoz","slug":"errcodeincorrectpassword","errorCode":"ErrCodeIncorrectPassword","errorMessage":"invalid email or password","messagePattern":"invalid email or password","errorType":"error_code","errorClass":"errors.SignozError","httpStatus":401,"severity":"error","filePath":"pkg/authn/passwordauthn/emailpasswordauthn/authn.go","lineNumber":30,"sourceCode":"\nvar _ authn.PasswordAuthN = (*AuthN)(nil)\n\ntype AuthN struct {\n\tstore authtypes.AuthNStore\n}\n\nfunc New(store authtypes.AuthNStore) *AuthN {\n\treturn &AuthN{store: store}\n}\n\nfunc (a *AuthN) Authenticate(ctx context.Context, email string, password string, orgID valuer.UUID) (*authtypes.Identity, error) {\n\tuser, factorPassword, _, err := a.store.GetActiveUserAndFactorPasswordByEmailAndOrgID(ctx, email, orgID)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif !factorPassword.Equals(password) {\n\t\treturn nil, errors.New(errors.TypeUnauthenticated, types.ErrCodeIncorrectPassword, \"invalid email or password\")\n\t}\n\n\treturn authtypes.NewPrincipalUserIdentity(user.ID, orgID, user.Email, authtypes.IdentNProviderTokenizer), nil\n}\n","sourceCodeStart":12,"sourceCodeEnd":35,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/authn/passwordauthn/emailpasswordauthn/authn.go#L12-L35","documentation":"Returned by email/password authentication when the stored password factor does not match the supplied password. The message deliberately says \"invalid email or password\" to avoid revealing which credential is wrong.","triggerScenarios":"Calling Authenticate (via CreatePasswordAuthNSession) with a password that fails factorPassword.Equals(password), i.e. wrong password (or wrong-hash-stored factor) for an active user found by email+orgID.","commonSituations":"User typos or stale credentials after a password reset; frontend sending trimmed/hashed password instead of the raw one; orgID mismatch so the right user record isn't found; password factor migrated with a different hashing scheme.","solutions":["Verify the user is typing the current password for the correct org (orgID matches the login page)","Check the client sends the raw password exactly (no double-hashing, no whitespace trimming) and correct email casing","If system-wide, verify password factor records/hashing config (e.g. bcrypt cost, migration) are consistent"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"id, err := authn.Authenticate(ctx, email, orgID, password)\nif err != nil {\n    if errors.Is(err, types.ErrCodeIncorrectPassword) || strings.Contains(err.Error(), \"invalid email or password\") {\n        // return 401 to user, do not leak which field was wrong\n        render.Error(rw, err)\n        return\n    }\n    return err // store failure etc.\n}","preventionTips":["Treat wrong-password errors as user input errors (401), not 500s","Rate-limit login attempts on this path","Never log the submitted password"],"tags":["authentication","password","login","go"],"backgroundTag":"invalid-credentials","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}