{"record":{"id":"874ddef9db0fe4ae","repo":"HeyPuter/puter","slug":"password-mismatch-874dde","errorCode":"password_mismatch","errorMessage":"Password mismatch","messagePattern":"Password mismatch","errorType":"exception","errorClass":"HttpError","httpStatus":400,"severity":"warning","filePath":"src/backend/core/http/middleware/userProtected.ts","lineNumber":236,"sourceCode":"                    oidcService,\n                    user,\n                );\n                throw new HttpError(403, 'OIDC revalidation required', {\n                    legacyCode: 'oidc_revalidation_required',\n                    fields,\n                });\n            }\n            let match = false;\n            try {\n                match = await bcrypt.compare(\n                    bodyPassword,\n                    String(user.password),\n                );\n            } catch {\n                match = false;\n            }\n            if (!match)\n                throw new HttpError(400, 'Password mismatch', {\n                    legacyCode: 'password_mismatch',\n                });\n            return next();\n        }\n\n        const cookieValue = req.cookies?.[REVALIDATION_COOKIE_NAME];\n        if (cookieValue) {\n            try {\n                const payload = tokenService.verify<RevalidationPayload>(\n                    'oidc-state',\n                    cookieValue,\n                );\n                if (\n                    payload?.purpose === 'revalidate' &&\n                    payload.user_uuid === user.uuid\n                ) {\n                    return next();\n                }","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/HeyPuter/puter/blob/908ec23eda38526170322c3edf71ba45ecb1ca95/src/backend/core/http/middleware/userProtected.ts#L218-L254","documentation":"Raised when `bcrypt.compare(bodyPassword, user.password)` returns false (or throws, which is treated as false). The submitted password does not match the account's stored hash — a wrong password, not an auth failure.","triggerScenarios":"Submitting an incorrect password in the body of a userProtected route (delete account, change password, etc.).","commonSituations":"Typo; caps lock; an old/forgotten password; password changed elsewhere since last entry.","solutions":["Re-enter the correct current password.","If forgotten, use the password-reset flow instead of retrying blindly.","In the GUI, re-surface the password prompt on this 400."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Basic non-empty check before posting:\nif (!body.password || !body.password.trim()) { showPasswordError(); return; }","typeGuard":null,"tryCatchPattern":"try { await call(body); }\ncatch (e) {\n  if (e.code === 'password_mismatch') { rePromptPassword(); return; }\n  throw e;\n}","preventionTips":["Prompt the user clearly for the current password on sensitive actions.","Offer a password-reset path instead of blind retries.","Validate non-empty input before submitting."],"tags":["password","auth","user-protected","mismatch"],"backgroundTag":null,"analyzedSha":"908ec23eda38526170322c3edf71ba45ecb1ca95","analyzedAt":"2026-08-12T20:53:15.911Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}