halo-dev/halo · error · UnsatisfiedAttributeValueException

validation.error.password.size

validation.error.password.size

Error message

password is required.

What it means

Thrown as an UnsatisfiedAttributeValueException (HTTP 400) with code 'validation.error.password.size' from the ChangeMyPasswordRequest compact constructor in the user-center endpoint. It fires when password is null, shorter than 5 chars, or longer than 257 chars — the same bounds as the console change-own-password, with i18n args [5,257].

Source

Thrown at application/src/main/java/run/halo/app/core/endpoint/uc/UcUserEndpoint.java:162

    /**
     * Payload for setting or changing the current user's password.
     *
     * @param oldPassword old password, required and verified only when the current user has a password; ignored
     *     otherwise
     * @param password new password of the current user
     */
    record ChangeMyPasswordRequest(
            @Schema(
                    description = "Old password. Required and verified only when the current user "
                            + "has a password; ignored otherwise.")
            String oldPassword,

            @Schema(requiredMode = REQUIRED, minLength = 5, maxLength = 257)
            String password) {

        public ChangeMyPasswordRequest {
            if (password == null || password.length() < 5 || password.length() > 257) {
                throw new UnsatisfiedAttributeValueException(
                        "password is required.", "validation.error.password.size", new Object[] {5, 257});
            }
        }
    }
}

View on GitHub (pinned to d2f5165f9c)

Solutions

1. Submit a new password with length between 5 and 257 inclusive.
2. Mirror the 5–257 bounds in the client UI and block submit outside that range.
3. Localize the failure via code 'validation.error.password.size' with args [5,257].

Example fix

// before:  { "password": "1234" }
// after:   { "oldPassword": "x", "password": "strong-pass-42" }

// enforce 5..257 length before the change-password request
String p = newPassword;
if (p == null || p.length() < 5 || p.length() > 257) {
    showUserError("Password must be 5–257 characters");
    return;
}

When it happens

Trigger: POST to the user-center change-my-password endpoint with a 'password' that is null, length < 5, or length > 257. The compact constructor validates eagerly before Spring binding validation.

Common situations: User submits empty new password; very long generated password exceeds 257 chars; client omitted the password field; weak '1234'-style test password; frontend lacks length guidance.

Related errors

• validation.error.password.size
• validation.error.email.pattern
• PluginModule.ucRoutes must be an array.
• No file part found in the request
• Invalid part of file

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/5a19db8d1499e9a2. Report an issue: GitHub.