{"id":"df3a19588dd4e1c0","repo":"tiangolo/fastapi","slug":"inactive-user-df3a19","errorCode":null,"errorMessage":"Inactive user","messagePattern":"Inactive user","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"docs_src/security/tutorial003_py310.py","lineNumber":69,"sourceCode":"    # Check the next version\n    user = get_user(fake_users_db, token)\n    return user\n\n\nasync def get_current_user(token: str = Depends(oauth2_scheme)):\n    user = fake_decode_token(token)\n    if not user:\n        raise HTTPException(\n            status_code=status.HTTP_401_UNAUTHORIZED,\n            detail=\"Not authenticated\",\n            headers={\"WWW-Authenticate\": \"Bearer\"},\n        )\n    return user\n\n\nasync def get_current_active_user(current_user: User = Depends(get_current_user)):\n    if current_user.disabled:\n        raise HTTPException(status_code=400, detail=\"Inactive user\")\n    return current_user\n\n\n@app.post(\"/token\")\nasync def login(form_data: OAuth2PasswordRequestForm = Depends()):\n    user_dict = fake_users_db.get(form_data.username)\n    if not user_dict:\n        raise HTTPException(status_code=400, detail=\"Incorrect username or password\")\n    user = UserInDB(**user_dict)\n    hashed_password = fake_hash_password(form_data.password)\n    if not hashed_password == user.hashed_password:\n        raise HTTPException(status_code=400, detail=\"Incorrect username or password\")\n\n    return {\"access_token\": user.username, \"token_type\": \"bearer\"}\n\n\n@app.get(\"/users/me\")\nasync def read_users_me(current_user: User = Depends(get_current_active_user)):","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/tiangolo/fastapi/blob/42a41db11f6882807ac3c057b942178d53b97438/docs_src/security/tutorial003_py310.py#L51-L87","documentation":"Same as error 43 in the default-parameter style: `get_current_active_user` raises HTTP 400 'Inactive user' when `current_user.disabled` is True. The user is already authenticated; the account is simply disabled. Sample user `alice` (`disabled: True`) triggers it.","triggerScenarios":"`GET /users/me` after authenticating as `alice`. `johndoe` (`disabled: False`) does not trigger it.","commonSituations":"Deactivated/suspended accounts; the `disabled` flag left True after reactivation; seeding users with the wrong flag; identical semantics to the Annotated variant.","solutions":["Use a non-disabled account (e.g. `johndoe`).","Set the user's `disabled` field to `False` in the store.","Show the end user a clear 'account disabled' notice; do not retry."],"exampleFix":"# before\nAuthorization: Bearer alice   # disabled -> 400\n# after\nAuthorization: Bearer johndoe  # active -> 200","handlingStrategy":"try-catch","validationCode":"None","typeGuard":"def is_inactive(resp) -> bool:\n    return getattr(resp, 'status_code', None) == 400 and resp.json().get('detail') == 'Inactive user'","tryCatchPattern":"try:\n    me = client.get('/users/me', headers=auth_header(token))\n    me.raise_for_status()\nexcept httpx.HTTPStatusError as e:\n    if e.response.status_code == 400 and e.response.json().get('detail') == 'Inactive user':\n        prompt_reactivation()\n    raise","preventionTips":["Do not retry 'Inactive user' - the token is fine, the account is off.","Keep `disabled` consistent with your admin workflow.","Offer a reactivation path rather than a raw 400."],"tags":["authorization","security","user-management","fastapi"],"analyzedSha":"42a41db11f6882807ac3c057b942178d53b97438","analyzedAt":"2026-08-04T19:23:32.007Z","schemaVersion":2}