{"record":{"id":"dd453b9f7be0fb95","repo":"phacility/phabricator","slug":"you-must-confirm-the-selected-password","errorCode":null,"errorMessage":"You must confirm the selected password.","messagePattern":"You must confirm the selected password\\.","errorType":"validation","errorClass":"PhabricatorAuthPasswordException","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/engine/PhabricatorAuthPasswordEngine.php","lineNumber":92,"sourceCode":"    }\n\n    $min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');\n    $min_len = (int)$min_len;\n    if ($min_len) {\n      if (strlen($raw_password) < $min_len) {\n        throw new PhabricatorAuthPasswordException(\n          pht(\n            'The selected password is too short. Passwords must be a minimum '.\n            'of %s characters long.',\n            new PhutilNumber($min_len)),\n          pht('Too Short'));\n      }\n    }\n\n    $raw_confirm = $confirm->openEnvelope();\n\n    if (!strlen($raw_confirm)) {\n      throw new PhabricatorAuthPasswordException(\n        pht('You must confirm the selected password.'),\n        null,\n        pht('Required'));\n    }\n\n    if ($raw_password !== $raw_confirm) {\n      throw new PhabricatorAuthPasswordException(\n        pht('The password and confirmation do not match.'),\n        pht('Invalid'),\n        pht('Invalid'));\n    }\n\n    if (PhabricatorCommonPasswords::isCommonPassword($raw_password)) {\n      throw new PhabricatorAuthPasswordException(\n        pht(\n          'The selected password is very weak: it is one of the most common '.\n          'passwords in use. Choose a stronger password.'),\n        pht('Very Weak'));","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/engine/PhabricatorAuthPasswordEngine.php#L74-L110","documentation":"After the password field passes its checks, checkNewPassword() opens the confirmation envelope; if the confirmation string is empty, this exception is thrown with null as the password error and 'Required' as the confirm error (getConfirmError()), so the UI can flag the confirmation field specifically.","triggerScenarios":"Submitting a password form where the confirm field was left blank while the password field was filled - any call to checkNewPassword($password, $confirm, ...) with an empty $confirm envelope.","commonSituations":"Forms where autofill fills only one field; browser extensions clearing the confirm box; users tabbing past the confirmation input; custom single-field forms that pass the same envelope but as an empty string.","solutions":["Fill in the confirmation field with the same password.","In custom flows, require the confirm input in the form definition before calling the engine.","Catch PhabricatorAuthPasswordException and use getConfirmError() to mark the confirmation field."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Require the confirm field at the form layer\nif (!strlen($confirm->openEnvelope())) {\n  $e_confirm = pht('Required');\n  return $this->buildPasswordFormResponse(null, $e_confirm);\n}","typeGuard":null,"tryCatchPattern":"try {\n  $engine->checkNewPassword($password, $confirm);\n} catch (PhabricatorAuthPasswordException $ex) {\n  $e_confirm = $ex->getConfirmError(); // 'Required' when confirm is empty\n  // re-render with the confirm field flagged\n}","preventionTips":["Make the confirmation input required in the form definition.","Beware autofill/extensions clearing only one of the two fields.","Map getConfirmError() to the confirm field, not the password field."],"tags":["phabricator","password","validation","empty-input","confirm-field","php"],"backgroundTag":"password-validation-failed","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}