{"record":{"id":"d11ed7c00ed14a39","repo":"RayWangQvQ/BiliBiliToolPro","slug":"current-password-is-incorrect","errorCode":null,"errorMessage":"Current password is incorrect.","messagePattern":"Current password is incorrect\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/Ray.BiliBiliTool.Web/Services/AuthService.cs","lineNumber":47,"sourceCode":"            );\n\n            return claimsIdentity;\n        }\n\n        return new ClaimsIdentity();\n    }\n\n    public async Task ChangePasswordAsync(\n        string username,\n        string currentPassword,\n        string newPassword\n    )\n    {\n        var user = await userRepository.GetAdminAsync();\n\n        if (!PasswordHelper.VerifyPassword(currentPassword, user.Salt, user.PasswordHash))\n        {\n            throw new Exception(\"Current password is incorrect.\");\n        }\n\n        var (hash, salt) = PasswordHelper.HashPassword(newPassword);\n\n        user.Salt = salt;\n        user.PasswordHash = hash;\n        user.Username = username;\n\n        await userRepository.UpdateAsync(user);\n    }\n\n    public async Task<string> GetAdminUserNameAsync()\n    {\n        var user = await userRepository.GetAdminAsync();\n        return user.Username;\n    }\n}\n","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/RayWangQvQ/BiliBiliToolPro/blob/c599b2c0da964e16ea8c454397aa07bb16212628/src/Ray.BiliBiliTool.Web/Services/AuthService.cs#L29-L65","documentation":"ChangePasswordAsync verifies the supplied currentPassword against the stored salted hash of the admin user via PasswordHelper.VerifyPassword; on mismatch it throws a plain Exception('Current password is incorrect.'). It is an authentication guard preventing password changes without knowing the existing password.","triggerScenarios":"Submitting the change-password form with a current password that doesn't match the stored hash — wrong password typed, wrong user record (no admin seeded correctly), or the password hash/salt columns altered or migrated incorrectly.","commonSituations":"User forgot the previously set admin password; fresh deployment where the default password differs from what the user enters; database reset replaced the hash but the user retries an old password; copy/paste whitespace in the password field.","solutions":["Re-enter the current password carefully (watch for trailing whitespace or keyboard-layout issues).","Use the default initial password on first login if the database was just seeded; change it afterwards.","If the password is truly lost, reset the admin row (re-seed or clear PasswordHash/Salt) via the documented recovery procedure or by deleting the data store.","Catch this in the UI layer and surface a friendly validation message instead of an unhandled exception."],"exampleFix":"// before\ntry { await authService.ChangePasswordAsync(current, next); }\ncatch { throw; }\n// after\ntry { await authService.ChangePasswordAsync(current, next); }\ncatch (Exception ex) when (ex.Message == \"Current password is incorrect.\")\n{\n    message = \"当前密码不正确\";\n    return;\n}","handlingStrategy":"validation","validationCode":"// client-side pre-check before submit\nif (string.IsNullOrWhiteSpace(currentPassword) || string.IsNullOrWhiteSpace(newPassword))\n{\n    message = \"请填写当前密码和新密码\";\n    return;\n}","typeGuard":null,"tryCatchPattern":"try { await authService.ChangePasswordAsync(current, next); message = \"密码修改成功\"; }\ncatch (Exception ex) when (ex.Message.Contains(\"password is incorrect\"))\n{\n    message = \"当前密码不正确，请重试\";\n}","preventionTips":["Re-type the current password carefully; watch whitespace and input method","Use the seeded default password on first login","After a DB reset, expect to re-seed the admin credential","Trim input in the form but never alter the password content itself"],"tags":["authentication","password","change-password","web"],"backgroundTag":"authentication-required","analyzedSha":"c599b2c0da964e16ea8c454397aa07bb16212628","analyzedAt":"2026-09-12T09:48:04.090Z","contentChangedAt":"2026-09-12T09:48:04.090Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}