What causes "Current password is incorrect." in fullstackhero/dotnet-starter-kit?

Re-enter the correct current password and retry

fullstackhero/dotnet-starter-kit · error · UnauthorizedException

Current password is incorrect.

Error message

Current password is incorrect.

What it means

DisableTwoFactorCommandHandler deliberately requires the current password before disabling two-factor authentication, so a stolen access token alone cannot downgrade account security. UnauthorizedException('Current password is incorrect.') is thrown when UserManager.CheckPasswordAsync returns false for command.CurrentPassword.

Solutions

Re-enter the correct current password and retry
Check the client payload maps the current-password input to CurrentPassword (not NewPassword/ConfirmNewPassword)
If the password is forgotten, recover access via the password-reset flow first, then retry disabling 2FA
Note passwords are case-sensitive and trimmed only if the identity config does so

Example fix

// before
await api.disableTwoFactor({ currentPassword: newPassword });
// after
await api.disableTwoFactor({ currentPassword: currentPasswordInput });

Defensive patterns

Strategy: validation

Validate before calling

function validateDisable2faInput(input) {
  return typeof input.currentPassword === 'string'
    && input.currentPassword.length > 0
    && input.currentPassword !== input.newPassword
    ? null : 'Current password is required and must differ from the new one.';
}

Try / catch

try {
  await api.disableTwoFactor({ currentPassword });
} catch (e) {
  if (e.status === 401 && /password is incorrect/i.test(e.message)) {
    showInlineError('Current password is incorrect.');
    return;
  }
  throw e;
}

Prevention

Bind the current-password field explicitly to the CurrentPassword payload key
Never prefill or cache passwords in the client
Offer a password-reset path when users forget their current password

When it happens

Trigger: Submitting the disable-2FA request with a wrong, empty, or stale current password; sending the new password field instead of the current one; calling the API from a script that never collected the password.

Common situations: User forgot which password they set; client form wires the wrong field into CurrentPassword; password was recently changed elsewhere and the old value is cached in the client; migration from another provider where hashes differ.

Related errors

AI-assisted analysis of fullstackhero/dotnet-starter-kit@3f2959e683 (2026-09-15). Data as JSON: /api/errors/eba57644e2887525. Report an issue: GitHub.

Appendix: source

Thrown at src/Modules/Identity/Modules.Identity/Features/v1/TwoFactor/Disable/DisableTwoFactorCommandHandler.cs:40

    public async ValueTask<bool> Handle(
        DisableTwoFactorCommand command, CancellationToken cancellationToken)
    {
        ArgumentNullException.ThrowIfNull(command);

        if (!_currentUser.IsAuthenticated())
        {
            throw new UnauthorizedException();
        }

        var userId = _currentUser.GetUserId().ToString();
        var user = await _userManager.FindByIdAsync(userId)
            ?? throw new NotFoundException($"User {userId} not found.");

        // Require current password so a stolen access token alone can't downgrade
        // account security.
        if (!await _userManager.CheckPasswordAsync(user, command.CurrentPassword))
        {
            throw new UnauthorizedException("Current password is incorrect.");
        }

        await _userManager.SetTwoFactorEnabledAsync(user, false);
        await _userManager.ResetAuthenticatorKeyAsync(user);
        return true;
    }
}

View on GitHub (pinned to 3f2959e683)