{"record":{"id":"afc127fd4de850cb","repo":"AlistGo/alist","slug":"password-is-incorrect","errorCode":null,"errorMessage":"password is incorrect","messagePattern":"password is incorrect","errorType":"exception","errorClass":"WrongPassword","httpStatus":null,"severity":"warning","filePath":"internal/errs/user.go","lineNumber":8,"sourceCode":"package errs\n\nimport \"errors\"\n\nvar (\n\tEmptyUsername      = errors.New(\"username is empty\")\n\tEmptyPassword      = errors.New(\"password is empty\")\n\tWrongPassword      = errors.New(\"password is incorrect\")\n\tDeleteAdminOrGuest = errors.New(\"cannot delete admin or guest\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":11,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/internal/errs/user.go#L1-L11","documentation":"WrongPassword ('password is incorrect') is a sentinel in internal/errs/user.go returned when a login attempt supplies a username that exists but a password whose hash does not match the stored one. It is the standard authentication-failure signal for the local user store.","triggerScenarios":"POST /auth/login with a valid username and wrong password; password changed elsewhere but the client retries with the old one; guest account login with a configured guest password that does not match; copy/paste artifacts (trailing spaces) in the submitted password.","commonSituations":"Forgotten or rotated passwords; environment credential drift between deployments; OAuth/SSO users trying to log in locally without a local password set; brute-force scans producing it repeatedly (pair with rate limiting).","solutions":["Reset the user's password via the admin panel or CLI if forgotten","Update stored credentials in scripts/secrets managers after rotation","Verify no whitespace or encoding issues in the submitted password","For SSO-only users, set a local password first or use the correct auth flow"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// confirm credentials are the intended ones before login\nif cached == nil || cached.Username != wantUsername { reauth() } // avoid stale creds","typeGuard":"func isWrongPassword(err error) bool {\n    return err != nil && errors.Is(errors.Cause(err), errs.WrongPassword)\n}","tryCatchPattern":"token, err := auth.Login(u, p)\nif isWrongPassword(err) {\n    // prompt/re-set credentials; do not retry with the same password\n}","preventionTips":["Rotate stored secrets alongside server-side password changes","Trim whitespace from pasted passwords","Rate-limit login endpoints against brute force","Distinguish this from EmptyPassword to give accurate UI messages"],"tags":["auth","login","password"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}