{"record":{"id":"e8a0518102bbec0e","repo":"unslothai/unsloth","slug":"new-password-must-be-different-from-the-current-pa","errorCode":null,"errorMessage":"New password must be different from the current password","messagePattern":"New password must be different from the current password","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"warning","filePath":"studio/backend/routes/auth.py","lineNumber":633,"sourceCode":"    if record is None:\n        raise HTTPException(\n            status_code = status.HTTP_401_UNAUTHORIZED,\n            detail = \"User session is invalid\",\n        )\n\n    salt, pwd_hash, _jwt_secret, _must_change_password = record\n    if not hashing.verify_password(payload.current_password, salt, pwd_hash):\n        raise HTTPException(\n            status_code = status.HTTP_401_UNAUTHORIZED,\n            detail = \"Current password is incorrect\",\n        )\n    if any(ch.isspace() for ch in payload.new_password):\n        raise HTTPException(\n            status_code = status.HTTP_400_BAD_REQUEST,\n            detail = \"New password cannot contain spaces\",\n        )\n    if payload.current_password == payload.new_password:\n        raise HTTPException(\n            status_code = status.HTTP_400_BAD_REQUEST,\n            detail = \"New password must be different from the current password\",\n        )\n\n    # Single transaction: a separate refresh-token purge could fail after the\n    # password commit, leaving pre-change tokens able to mint access tokens.\n    # Conditional on the hash just verified: a reset-password that landed while\n    # this request was in flight must not be overwritten by it.\n    # The desktop app authenticates with a local secret rather than this\n    # password; revoking that secret would break its auto-auth over a change it\n    # made itself. A browser session still revokes it.\n    new_secret = storage.update_password(\n        current_subject,\n        payload.new_password,\n        revoke_refresh_tokens = True,\n        expect_password_hash = pwd_hash,\n        preserve_desktop_secret = is_desktop,\n    )","sourceCodeStart":615,"sourceCodeEnd":651,"githubUrl":"https://github.com/unslothai/unsloth/blob/203007d19051dcd2ae33876786d117c99f6b0368/studio/backend/routes/auth.py#L615-L651","documentation":"/change-password refuses no-op changes: if new_password equals current_password it returns HTTP 400 'New password must be different from the current password'. Note the comparison is exact string equality against the submitted current_password, which has already been verified against the stored hash by this point.","triggerScenarios":"Submitting identical current and new password values, including via a UI bug that pre-fills the new-password field with the current one.","commonSituations":"Forms that copy the current password into the new field; 'change' clicks that submit unchanged values; automated rotation scripts falling back to the old value.","solutions":["Choose a genuinely different new password","Disable the submit button client-side until new != current","In rotation scripts, assert new_password != current_password before calling"],"exampleFix":"# before\nbody = {\"current_password\": pw, \"new_password\": pw}\n# after\nassert new_pw != pw\nbody = {\"current_password\": pw, \"new_password\": new_pw}","handlingStrategy":"validation","validationCode":"def distinct_new_password(cur: str, new: str) -> bool:\n    return new != cur","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Disable submit until new differs from current","Assert inequality in rotation scripts before calling the API"],"tags":["http","auth","password","validation"],"backgroundTag":null,"analyzedSha":"203007d19051dcd2ae33876786d117c99f6b0368","analyzedAt":"2026-08-15T02:48:39.846Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}