apolloconfig/apollo · warning · BadRequestException

Password needs a number and letter and between 8~20 characte

Error message

Password needs a number and letter and between 8~20 characters

What it means

Surfaced via UserInfoController.createOrUpdateUser from AuthUserPasswordChecker.checkWeakPassword. The password fails the regex ^(?=.*[0-9].*)(?=.*[a-zA-Z].*).{8,20}$, meaning it lacks a digit, lacks a letter, or is not 8-20 characters long. Returned as BadRequestException (HTTP 400).

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/UserInfoController.java:83

  }

  @PostMapping("/users")
  public void createOrUpdateUser(
      @RequestParam(value = "isCreate", defaultValue = "false") boolean isCreate,
      @RequestBody UserPO user) {
    if (StringUtils.isContainEmpty(user.getUsername(), user.getPassword())) {
      throw new BadRequestException("Username and password can not be empty.");
    }

    if (!unifiedPermissionValidator.isSuperAdmin()
        && (!user.getUsername().equals(userInfoHolder.getUser().getUserId())
            || user.getEnabled() != USER_ENABLED)) {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }

    CheckResult pwdCheckRes = passwordChecker.checkWeakPassword(user.getPassword());
    if (!pwdCheckRes.isSuccess()) {
      throw new BadRequestException(pwdCheckRes.getMessage());
    }

    if (userService instanceof SpringSecurityUserService) {
      if (isCreate) {
        ((SpringSecurityUserService) userService).create(user);
      } else {
        ((SpringSecurityUserService) userService).update(user);
      }
    } else {
      throw new UnsupportedOperationException("Create or update user operation is unsupported");
    }
  }

  @PreAuthorize(value = "@unifiedPermissionValidator.isSuperAdmin()")
  @PutMapping("/users/enabled")
  public void changeUserEnabled(@RequestBody UserPO user) {
    if (userService instanceof SpringSecurityUserService) {
      ((SpringSecurityUserService) userService).changeEnabled(user);

View on GitHub (pinned to d95fc18d11)

Solutions

1. Choose a password containing at least one letter and one digit, length 8-20.
2. If generating passwords programmatically, enforce the same regex before submission.
3. Communicate the policy to end users in the UI before they submit.

Example fix

// before
String pwd = "password"; // no digit

// after
String pwd = generatedPassword(); // ensure matches ^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$
if (!pwd.matches("^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$")) {
  throw new IllegalArgumentException("weak password");
}

private static final Pattern PWD = Pattern.compile("^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$");
if (!PWD.matcher(password).matches()) {
  return ResponseEntity.badRequest().body("password must be 8-20 chars with a letter and a digit");
}

boolean meetsPasswordPolicy(String p) { return p != null && p.matches("^(?=.*[0-9])(?=.*[a-zA-Z]).{8,20}$"); }

When it happens

Trigger: POST /users (create or update) with a password that is all-letters, all-digits, shorter than 8, or longer than 20 characters.

Common situations: User picks a simple password; automated provisioning uses a numeric-only token; password generator emits a >20 char string that exceeds the cap; legacy password migrated without meeting the policy.

Related errors

• Username and password can not be empty.
• Passwords cannot be consecutive, regular letters or numbers.
• userIds should not be null or empty
• operator should not be null or empty
• ConsumerApp not exist

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/18491a258385d3eb. Report an issue: GitHub.