{"record":{"id":"9f9bccb7dd268d16","repo":"invoke-ai/InvokeAI","slug":"current-password-is-required-to-set-a-new-password","errorCode":null,"errorMessage":"Current password is required to set a new password","messagePattern":"Current password is required to set a new password","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"invokeai/app/api/routers/auth.py","lineNumber":734,"sourceCode":"        request: Profile fields to update\n        current_user: The authenticated user\n        http_request: The HTTP request, used to scope the replacement media cookie\n        response: The HTTP response, used to return the replacement token\n\n    Returns:\n        The updated user\n\n    Raises:\n        HTTPException: 400 if current password is incorrect or new password is weak\n        HTTPException: 404 if user not found\n    \"\"\"\n    user_service = ApiDependencies.invoker.services.users\n    config = ApiDependencies.invoker.services.configuration\n\n    # Verify current password when attempting a password change\n    if request.new_password is not None:\n        if not request.current_password:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=\"Current password is required to set a new password\",\n            )\n\n        # Re-authenticate to verify the current password\n        user = user_service.get(current_user.user_id)\n        if user is None:\n            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=\"User not found\")\n\n        authenticated = user_service.authenticate(user.email, request.current_password)\n        if authenticated is None:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=\"Current password is incorrect\",\n            )\n\n    try:\n        changes = UserUpdateRequest(","sourceCodeStart":716,"sourceCodeEnd":752,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/auth.py#L716-L752","documentation":"update_current_user requires the current password whenever a new password is requested. If PATCH /auth/me includes new_password but omits current_password, the endpoint raises 400 'Current password is required to set a new password'. This is a re-authentication guard preventing session hijackers from silently changing the password.","triggerScenarios":"PATCH /auth/me (update_current_user) with a body containing new_password set but current_password null/empty/missing.","commonSituations":"Client form only sends changed fields and treats current_password as optional; password-manager autofill skipping the current-password field; API consumers assuming password change needs no re-auth.","solutions":["Include current_password in the PATCH body whenever new_password is set","Fix the client form so the current-password field is required and validated before submit","If you only want to change username/email, omit new_password entirely"],"exampleFix":"// before\napi.patch('/auth/me', { new_password: 'hunter2' }); // 400\n// after\napi.patch('/auth/me', { new_password: 'hunter2', current_password: 'oldPass' });","handlingStrategy":"validation","validationCode":"if (payload.new_password && !payload.current_password) {\n  throw new Error('current_password is required when changing the password');\n}\nawait api.patch('/auth/me', payload);","typeGuard":"function hasPasswordChange(p): p is { new_password: string; current_password: string } {\n  return typeof p.new_password === 'string' && typeof p.current_password === 'string' && p.current_password.length > 0;\n}","tryCatchPattern":"try {\n  await api.patch('/auth/me', payload);\n} catch (e) {\n  if (e.response?.status === 400 && e.response?.data?.detail?.includes('Current password is required')) {\n    promptForCurrentPassword();\n  } else throw e;\n}","preventionTips":["Always send current_password alongside new_password in profile updates","Make the current-password field required in password-change forms with client-side validation","Only send fields actually being changed; omit new_password for profile-only edits"],"tags":["http-400","password-change","validation","auth"],"backgroundTag":"current-password-required","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}