{"record":{"id":"d6f0c8407b9cda0f","repo":"mattermost-community/focalboard","slug":"invalid-username-or-password","errorCode":null,"errorMessage":"invalid username or password","messagePattern":"invalid username or password","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"server/app/auth.go","lineNumber":102,"sourceCode":"\t\tuser, err = a.store.GetUserByUsername(username)\n\t\tif err != nil && !model.IsErrNotFound(err) {\n\t\t\ta.metrics.IncrementLoginFailCount(1)\n\t\t\treturn \"\", errors.Wrap(err, \"invalid username or password\")\n\t\t}\n\t}\n\n\tif user == nil && email != \"\" {\n\t\tvar err error\n\t\tuser, err = a.store.GetUserByEmail(email)\n\t\tif err != nil && model.IsErrNotFound(err) {\n\t\t\ta.metrics.IncrementLoginFailCount(1)\n\t\t\treturn \"\", errors.Wrap(err, \"invalid username or password\")\n\t\t}\n\t}\n\n\tif user == nil {\n\t\ta.metrics.IncrementLoginFailCount(1)\n\t\treturn \"\", errors.New(\"invalid username or password\")\n\t}\n\n\tif !auth.ComparePassword(user.Password, password) {\n\t\ta.metrics.IncrementLoginFailCount(1)\n\t\ta.logger.Debug(\"Invalid password for user\", mlog.String(\"userID\", user.ID))\n\t\treturn \"\", errors.New(\"invalid username or password\")\n\t}\n\n\tauthService := user.AuthService\n\tif authService == \"\" {\n\t\tauthService = \"native\"\n\t}\n\n\tsession := model.Session{\n\t\tID:          utils.NewID(utils.IDTypeSession),\n\t\tToken:       utils.NewID(utils.IDTypeToken),\n\t\tUserID:      user.ID,\n\t\tAuthService: authService,","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/mattermost-community/focalboard/blob/a84bbb65e32edf972856b329417096ac413518e9/server/app/auth.go#L84-L120","documentation":"Login returns this when the username lookup fails, wrapped over the store error. The message is deliberately generic to avoid leaking which usernames exist. The first of three failure paths that share the same message.","triggerScenarios":"a.Login(id, password, mfaToken) where store.GetUserByEmail/ByUsername returns an unknown-user error for the given login identifier.","commonSituations":"Typoed username/email; user account removed or deactivated; wrong email domain; test fixtures pointing at a fresh database with no users.","solutions":["Verify the username/email exists and is spelled correctly","Confirm the account exists in the configured datastore","Check the app is pointed at the intended database (env/config)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if username == \"\" || password == \"\" {\n    return errors.New(\"username and password are required\")\n}","typeGuard":null,"tryCatchPattern":"token, err := a.Login(id, password, mfaToken)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid username or password\") {\n        return ErrBadCredentials // surface neutral auth failure to client\n    }\n    return errors.Wrap(err, \"login failed\")\n}","preventionTips":["Show one neutral 'invalid username or password' message for both unknown user and bad password","Verify DB/env config when many users suddenly fail to log in","Track login-fail metrics (IncrementLoginFailCount) and alert on spikes"],"tags":["auth","login","credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"a84bbb65e32edf972856b329417096ac413518e9","analyzedAt":"2026-08-30T09:22:20.720Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}