{"record":{"id":"852bde78320fa9d4","repo":"SonarSource/sonarqube","slug":"new-password-same-as-old","errorCode":"new_password_same_as_old","errorMessage":"Password must be different from old password","messagePattern":"Password must be different from old password","errorType":"validation","errorClass":"PasswordException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java","lineNumber":199,"sourceCode":"  private static String getParamOrThrow(HttpRequest request, String key) throws PasswordException {\n    String value = request.getParameter(key);\n    if (isNullOrEmpty(value)) {\n      throw new PasswordException(format(MSG_PARAMETER_MISSING, key));\n    }\n    return value;\n  }\n\n  private void checkPreviousPassword(DbSession dbSession, UserDto user, String password) throws PasswordException {\n    try {\n      localAuthentication.authenticate(dbSession, user, password, AuthenticationEvent.Method.BASIC);\n    } catch (AuthenticationException ex) {\n      throw new PasswordException(OLD_PASSWORD_INCORRECT, \"Incorrect password\");\n    }\n  }\n\n  private static void checkNewPasswordSameAsOld(String newPassword, String previousPassword) throws PasswordException {\n    if (previousPassword.equals(newPassword)) {\n      throw new PasswordException(NEW_PASSWORD_SAME_AS_OLD, \"Password must be different from old password\");\n    }\n  }\n\n  private UserDto getUserOrThrow(DbSession dbSession, String login) {\n    UserDto user = dbClient.userDao().selectByLogin(dbSession, login);\n    if (user == null || !user.isActive()) {\n      throw new NotFoundException(format(\"User with login '%s' has not been found\", login));\n    }\n    return user;\n  }\n\n  private void deleteTokensAndRefreshSession(HttpRequest request, HttpResponse response, DbSession dbSession, UserDto user) {\n    dbClient.sessionTokensDao().deleteByUser(dbSession, user);\n    refreshJwtToken(request, response, user);\n  }\n\n  private void refreshJwtToken(HttpRequest request, HttpResponse response, UserDto user) {\n    jwtHttpHandler.removeToken(request, response);","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/user/ws/ChangePasswordAction.java#L181-L217","documentation":"checkNewPasswordSameAsOld rejects a change request where the new password equals the previous one, throwing PasswordException with code new_password_same_as_old. This enforces that each change actually rotates the credential.","triggerScenarios":"POST api/users/change_password where new_password string-equals previous_password.","commonSituations":"Users re-submitting the same password to 'refresh' it; automation retry loops resending the same pair after a partial success; forms prefilling both fields identically.","solutions":["Choose a genuinely different new password","Fix automation to track whether the change already succeeded and not resend identical values","Remove identical-value prefill from client forms"],"exampleFix":"// before\nPOST ...?previous_password=Abc123!&new_password=Abc123!\n// after\nPOST ...?previous_password=Abc123!&new_password=Xyz789#","handlingStrategy":"validation","validationCode":"if (newPassword === previousPassword) throw new Error('New password must differ from the old one');","typeGuard":null,"tryCatchPattern":"try { await changePassword(login, oldPw, newPw); } catch (e) { if (e.code === 'new_password_same_as_old') { promptForDifferentPassword(); return; } throw e; }","preventionTips":["Compare old and new client-side before submitting","Track completion state in automation to avoid resubmitting identical pairs","Enforce a password history/difference rule in the form UI"],"tags":["password","users","api","validation"],"backgroundTag":"invalid-state-transition","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}