{"record":{"id":"df51024af4383971","repo":"alibaba/spring-ai-alibaba","slug":"accountpasswordnotmatch","errorCode":"AccountPasswordNotMatch","errorMessage":"Account password does not match.","messagePattern":"Account password does not match\\.","errorType":"error_code","errorClass":"BizException","httpStatus":400,"severity":"error","filePath":"spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/base/service/impl/AccountServiceImpl.java","lineNumber":473,"sourceCode":"\n\t\treturn toAccountDTO(entity);\n\t}\n\n\t/**\n\t * Changes user password\n\t * @param request Password change request\n\t */\n\t@Override\n\tpublic void changePassword(ChangePasswordRequest request) {\n\t\tRequestContext context = RequestContextHolder.getRequestContext();\n\t\tAccountEntity entity = getAccountById(context.getAccountId());\n\n\t\tif (Objects.isNull(entity)) {\n\t\t\tthrow new BizException(ErrorCode.ACCOUNT_NOT_FOUND.toError());\n\t\t}\n\n\t\tif (!PasswordCryptUtils.match(request.getPassword(), entity.getPassword())) {\n\t\t\tthrow new BizException(ErrorCode.ACCOUNT_PASSWORD_NOT_MATCH.toError());\n\t\t}\n\n\t\tString newEncodedPassword = PasswordCryptUtils.encode(request.getNewPassword());\n\t\tentity.setPassword(newEncodedPassword);\n\t\tentity.setGmtModified(new Date());\n\t\tthis.updateById(entity);\n\n\t\tString key = getAccountCacheKey(context.getAccountId());\n\t\tredisManager.put(key, entity);\n\t}\n\n\t/**\n\t * Gets current user's profile\n\t * @return Account profile\n\t */\n\t@Override\n\tpublic Account getAccountProfile() {\n\t\tRequestContext context = RequestContextHolder.getRequestContext();","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/alibaba/spring-ai-alibaba/blob/f82da0b50f35744c13968191be2b1cd2452ef550/spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/base/service/impl/AccountServiceImpl.java#L455-L491","documentation":"BizException thrown by changePassword when request.getPassword() (the current/old password) does not match the stored bcrypt-encoded password. PasswordCryptUtils.match fails, so the change is aborted with ErrorCode.ACCOUNT_PASSWORD_NOT_MATCH before the new password is encoded and saved.","triggerScenarios":"Submitting a changePassword request whose current-password field is wrong, empty, or belongs to a different account; also triggered after a password was already changed elsewhere so the stored hash differs from what the user supplies.","commonSituations":"Typo or caps-lock in the 'current password' field; user changed the password in another tab/device and retries with the old one; front end sending the NEW password in the old-password field; password set via admin reset so the user's remembered old password is outdated.","solutions":["Re-enter the current (old) password carefully — verify with PasswordCryptUtils.match logic mentally: it must match the stored hash","Ensure the client maps the correct form field to ChangePasswordRequest.password (old) vs newPassword (new)","If the password was reset/forgotten, use an admin password reset or 'forgot password' flow instead of changePassword","Catch BizException code AccountPasswordNotMatch and show a 'current password is incorrect' message with a limited retry count"],"exampleFix":"// before\nChangePasswordRequest req = new ChangePasswordRequest();\nreq.setPassword(newPassword); // WRONG: this is the old-password field\n// after\nChangePasswordRequest req = new ChangePasswordRequest();\nreq.setPassword(currentPassword); // must match stored hash\nreq.setNewPassword(newPassword);\naccountService.changePassword(req);","handlingStrategy":"try-catch","validationCode":"if (currentPassword == null || currentPassword.isBlank()) {\n    throw new IllegalArgumentException(\"Current password is required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    accountService.changePassword(request);\n} catch (BizException e) {\n    if (\"AccountPasswordNotMatch\".equals(e.getCode())) {\n        throw new UserFacingException(\"Your current password is incorrect.\");\n    }\n    throw e;\n}","preventionTips":["Verify the client binds the OLD password to request.password and the NEW one to newPassword","Limit retries and add rate limiting on password-change endpoints","Warn users if their password was recently changed in another session","Prefer a 'forgot password' flow over changePassword when the old password is unknown"],"tags":["account","password","authentication","business-exception"],"backgroundTag":"invalid-credentials","analyzedSha":"f82da0b50f35744c13968191be2b1cd2452ef550","analyzedAt":"2026-09-09T15:32:42.421Z","contentChangedAt":"2026-09-09T15:32:42.421Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}