{"record":{"id":"de1836dbe362d6ae","repo":"unslothai/unsloth","slug":"new-password-cannot-contain-spaces","errorCode":null,"errorMessage":"New password cannot contain spaces","messagePattern":"New password cannot contain spaces","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"studio/backend/routes/auth.py","lineNumber":572,"sourceCode":"            status_code = status.HTTP_403_FORBIDDEN,\n            detail = \"This action requires the Unsloth desktop app.\",\n        )\n\n    record = storage.get_user_and_secret(current_subject)\n    if record is None:\n        raise HTTPException(\n            status_code = status.HTTP_401_UNAUTHORIZED,\n            detail = \"User session is invalid\",\n        )\n\n    _salt, pwd_hash, _jwt_secret, must_change_password = record\n    if not must_change_password:\n        raise HTTPException(\n            status_code = status.HTTP_409_CONFLICT,\n            detail = \"A password is already set. Change it instead.\",\n        )\n    if any(ch.isspace() for ch in payload.new_password):\n        raise HTTPException(\n            status_code = status.HTTP_400_BAD_REQUEST,\n            detail = \"New password cannot contain spaces\",\n        )\n\n    # Conditional on the credential just read: a web password change or a\n    # reset-password landing while this request is in flight must not be\n    # overwritten by a caller that verified no password at all.\n    new_secret = storage.update_password(\n        current_subject,\n        payload.new_password,\n        revoke_refresh_tokens = True,\n        expect_password_hash = pwd_hash,\n        preserve_desktop_secret = True,\n    )\n    if new_secret is None:\n        raise HTTPException(\n            status_code = status.HTTP_409_CONFLICT,\n            detail = \"The password changed while this request was in flight. Try again.\",","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/routes/auth.py#L554-L590","documentation":"/set-password-from-desktop rejects new passwords containing any whitespace character (checked via `any(ch.isspace() for ch in payload.new_password)`) with HTTP 400 'New password cannot contain spaces'. The rule covers all Unicode whitespace, not just the space character, because the bootstrap password is printed to a terminal and copied back — spaces break copy/paste round-trips.","triggerScenarios":"Submitting a new password containing spaces, tabs, newlines, or non-breaking spaces; pasting a password that picked up a trailing newline from the clipboard.","commonSituations":"Passphrase-style passwords with word separators; clipboard artifacts; input fields that do not trim.","solutions":["Choose a password without whitespace, using hyphens or punctuation as separators","Strip leading/trailing whitespace client-side before submitting: `pw.strip()`","Validate with `''.join(ch for ch in pw if not ch.isspace())` or simply reject `any(ch.isspace() ...)` in the UI"],"exampleFix":"# before\nbody = {\"new_password\": \"my passphrase 2026\"}\n# after\nbody = {\"new_password\": \"my-passphrase-2026\"}","handlingStrategy":"validation","validationCode":"def password_ok(pw: str) -> bool:\n    return len(pw) > 0 and not any(ch.isspace() for ch in pw)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim pasted passwords before submission","Enforce the no-whitespace rule in the UI so the server never sees it"],"tags":["http","auth","password","validation"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}