{"record":{"id":"e49d70e6deb71ef4","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-password","errorCode":"error-invalid-password","errorMessage":"Invalid password","messagePattern":"Invalid password","errorType":"exception","errorClass":"Meteor.Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/meteor-methods/users/deleteUserOwnAccount.ts","lineNumber":47,"sourceCode":"\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t});\n\t}\n\n\tconst user = await Users.findOneById(fromUserId);\n\tif (!user) {\n\t\tthrow new Meteor.Error('error-invalid-user', 'Invalid user', {\n\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t});\n\t}\n\n\tif (user.services?.password && trim(user.services.password.bcrypt)) {\n\t\tconst result = await Accounts._checkPasswordAsync(user as Meteor.User, {\n\t\t\tdigest: password.toLowerCase(),\n\t\t\talgorithm: 'sha-256',\n\t\t});\n\t\tif (result.error) {\n\t\t\tthrow new Meteor.Error('error-invalid-password', 'Invalid password', {\n\t\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t\t});\n\t\t}\n\t} else if (!user.username || SHA256(user.username) !== password.trim()) {\n\t\tthrow new Meteor.Error('error-invalid-username', 'Invalid username', {\n\t\t\tmethod: 'deleteUserOwnAccount',\n\t\t});\n\t}\n\n\tawait deleteUser(fromUserId, confirmRelinquish);\n\n\t// App IPostUserDeleted event hook\n\tawait Apps.self?.triggerEvent(AppEvents.IPostUserDeleted, { user });\n\n\treturn true;\n};\n\nMeteor.methods<ServerMethods>({","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/meteor-methods/users/deleteUserOwnAccount.ts#L29-L65","documentation":"The account has a local password (services.password.bcrypt non-empty) and Accounts._checkPasswordAsync rejected the credential with error-invalid-password. The password argument is not the raw password: the server lowercases it and compares it as a sha-256 digest against bcrypt, so the client must send SHA256(password) in hex. Any wrong password or wrong digest scheme fails here.","triggerScenarios":"Wrong password entered; or a custom client sending the plaintext password, a base64 digest, or any non-sha256-hex value instead of the hex sha256 digest the stock client computes.","commonSituations":"Custom clients that skip the client-side SHA-256 hashing step; password changed after the page loaded; users typing the wrong credential on the delete-confirmation dialog.","solutions":["Send sha256(password) as a hex string exactly like the stock client does","Verify the password is correct by re-authenticating before retrying the delete","If the password was recently changed, re-prompt and re-hash before the call"],"exampleFix":"// before — raw password sent\nawait Meteor.callAsync('deleteUserOwnAccount', myPassword, false);\n\n// after — hex sha256 digest\nconst digest = SHA256(myPassword).toString();\nawait Meteor.callAsync('deleteUserOwnAccount', digest, false);","handlingStrategy":"try-catch","validationCode":"// client: always send the digest the server expects\nconst digest = SHA256(password).toString(); // hex, lowercase-safe\nawait Meteor.callAsync('deleteUserOwnAccount', digest, false);","typeGuard":null,"tryCatchPattern":"try {\n\tawait Meteor.callAsync('deleteUserOwnAccount', digest, false);\n} catch (err) {\n\tif ((err as { error?: string }).error === 'error-invalid-password') {\n\t\t// wrong password or wrong digest scheme — re-prompt, do not retry blindly\n\t}\n}","preventionTips":["Hash with SHA-256 hex on the client exactly once — never send the raw password","Do not send base64 or salted digests; the server lowercases and compares as sha-256","Re-prompt for the password instead of auto-retrying after a failure"],"tags":["meteor","authentication","account-deletion","password","sha256"],"backgroundTag":"invalid-password-credentials","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}