{"record":{"id":"c9dbcdccef31bbba","repo":"dgraph-io/dgraph","slug":"invalid-password-crypted-string","errorCode":null,"errorMessage":"Invalid password/crypted string","messagePattern":"Invalid password/crypted string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"types/password.go","lineNumber":34,"sourceCode":"\n// Encrypt encrypts the given plain-text password.\nfunc Encrypt(plain string) (string, error) {\n\tif len(plain) < pwdLenLimit {\n\t\treturn \"\", errors.Errorf(\"Password too short, i.e. should have at least 6 chars\")\n\t}\n\n\tencrypted, err := bcrypt.GenerateFromPassword([]byte(plain), bcrypt.DefaultCost)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn string(encrypted), nil\n}\n\n// VerifyPassword checks that the plain-text password matches the encrypted password.\nfunc VerifyPassword(plain, encrypted string) error {\n\tif len(plain) < pwdLenLimit || len(encrypted) == 0 {\n\t\treturn errors.Errorf(\"Invalid password/crypted string\")\n\t}\n\n\treturn bcrypt.CompareHashAndPassword([]byte(encrypted), []byte(plain))\n}\n","sourceCodeStart":16,"sourceCodeEnd":39,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/types/password.go#L16-L39","documentation":"Thrown by VerifyPassword when inputs are unusable: the plain password is shorter than 6 characters or the encrypted (bcrypt hash) string is empty. It guards bcrypt.CompareHashAndPassword from being called with degenerate inputs.","triggerScenarios":"Calling VerifyPassword with a <6 char plain password, or with an empty encrypted value — typically when the stored hash is missing, the DB column is empty, or a record was created without a password.","commonSituations":"Users whose account record has no stored hash (e.g. OAuth-only accounts) attempting password login; truncated or reset password columns; checking a short password.","solutions":["Check that the stored hash is non-empty before calling VerifyPassword and route to a 'no password set' flow otherwise","Enforce the same 6-char minimum at login/signup so plain input never fails here","Treat this error as an invalid-credential condition and re-hash/repair records with missing hashes"],"exampleFix":"// before\nerr := types.VerifyPassword(plain, storedHash) // storedHash may be \"\"\n// after\nif storedHash == \"\" {\n    return ErrNoPasswordSet\n}\nif len(plain) < 6 {\n    return ErrInvalidCredentials\n}\nerr := types.VerifyPassword(plain, storedHash)","handlingStrategy":"validation","validationCode":"if len(plain) < 6 {\n    return errors.New(\"password too short\")\n}\nif len(encrypted) == 0 {\n    return errors.New(\"no password stored for this account\")\n}","typeGuard":null,"tryCatchPattern":"if err := types.VerifyPassword(plain, stored); err != nil {\n    // uniform response: ErrInvalidCredentials (do not leak whether hash was empty)\n    return ErrInvalidCredentials\n}","preventionTips":["Check for empty hash columns during login before verifying","Handle OAuth-only accounts that have no bcrypt hash","Backfill/re-hash records with empty stored passwords"],"tags":["password","validation","bcrypt"],"backgroundTag":"invalid-credentials","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}