{"record":{"id":"eba57644e2887525","repo":"fullstackhero/dotnet-starter-kit","slug":"current-password-is-incorrect","errorCode":null,"errorMessage":"Current password is incorrect.","messagePattern":"Current password is incorrect\\.","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"src/Modules/Identity/Modules.Identity/Features/v1/TwoFactor/Disable/DisableTwoFactorCommandHandler.cs","lineNumber":40,"sourceCode":"    public async ValueTask<bool> Handle(\n        DisableTwoFactorCommand command, CancellationToken cancellationToken)\n    {\n        ArgumentNullException.ThrowIfNull(command);\n\n        if (!_currentUser.IsAuthenticated())\n        {\n            throw new UnauthorizedException();\n        }\n\n        var userId = _currentUser.GetUserId().ToString();\n        var user = await _userManager.FindByIdAsync(userId)\n            ?? throw new NotFoundException($\"User {userId} not found.\");\n\n        // Require current password so a stolen access token alone can't downgrade\n        // account security.\n        if (!await _userManager.CheckPasswordAsync(user, command.CurrentPassword))\n        {\n            throw new UnauthorizedException(\"Current password is incorrect.\");\n        }\n\n        await _userManager.SetTwoFactorEnabledAsync(user, false);\n        await _userManager.ResetAuthenticatorKeyAsync(user);\n        return true;\n    }\n}\n","sourceCodeStart":22,"sourceCodeEnd":48,"githubUrl":"https://github.com/fullstackhero/dotnet-starter-kit/blob/3f2959e683e9f83f13e55e1678c9119f63c7e8e5/src/Modules/Identity/Modules.Identity/Features/v1/TwoFactor/Disable/DisableTwoFactorCommandHandler.cs#L22-L48","documentation":"DisableTwoFactorCommandHandler deliberately requires the current password before disabling two-factor authentication, so a stolen access token alone cannot downgrade account security. UnauthorizedException('Current password is incorrect.') is thrown when UserManager.CheckPasswordAsync returns false for command.CurrentPassword.","triggerScenarios":"Submitting the disable-2FA request with a wrong, empty, or stale current password; sending the new password field instead of the current one; calling the API from a script that never collected the password.","commonSituations":"User forgot which password they set; client form wires the wrong field into CurrentPassword; password was recently changed elsewhere and the old value is cached in the client; migration from another provider where hashes differ.","solutions":["Re-enter the correct current password and retry","Check the client payload maps the current-password input to CurrentPassword (not NewPassword/ConfirmNewPassword)","If the password is forgotten, recover access via the password-reset flow first, then retry disabling 2FA","Note passwords are case-sensitive and trimmed only if the identity config does so"],"exampleFix":"// before\nawait api.disableTwoFactor({ currentPassword: newPassword });\n// after\nawait api.disableTwoFactor({ currentPassword: currentPasswordInput });","handlingStrategy":"validation","validationCode":"function validateDisable2faInput(input) {\n  return typeof input.currentPassword === 'string'\n    && input.currentPassword.length > 0\n    && input.currentPassword !== input.newPassword\n    ? null : 'Current password is required and must differ from the new one.';\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.disableTwoFactor({ currentPassword });\n} catch (e) {\n  if (e.status === 401 && /password is incorrect/i.test(e.message)) {\n    showInlineError('Current password is incorrect.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Bind the current-password field explicitly to the CurrentPassword payload key","Never prefill or cache passwords in the client","Offer a password-reset path when users forget their current password"],"tags":["authentication","password","security","two-factor"],"backgroundTag":"invalid-password","analyzedSha":"3f2959e683e9f83f13e55e1678c9119f63c7e8e5","analyzedAt":"2026-09-15T22:20:53.684Z","contentChangedAt":"2026-09-15T22:20:53.684Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}