halo-dev/halo · error · UnsatisfiedAttributeValueException

validation.error.password.size

validation.error.password.size

Error message

password is required.

What it means

Thrown as an UnsatisfiedAttributeValueException (HTTP 400) with code 'validation.error.password.size' from the ChangeOwnPasswordRequest compact constructor. It fires when password is null, shorter than 5 chars, or longer than 257 chars. The code is an i18n key with args [5,257] for localized messaging.

Source

Thrown at application/src/main/java/run/halo/app/core/endpoint/console/UserEndpoint.java:663

                .flatMap(updatedUser -> ServerResponse.ok()
                        .contentType(MediaType.APPLICATION_JSON)
                        .bodyValue(updatedUser));
    }

    /**
     * Payload for changing the current user's password.
     *
     * @param oldPassword old password
     * @param password new password
     */
    record ChangeOwnPasswordRequest(
            @Schema(requiredMode = REQUIRED) String oldPassword,

            @Schema(requiredMode = REQUIRED, minLength = 5) String password) {

        public ChangeOwnPasswordRequest {
            if (password == null || password.length() < 5 || password.length() > 257) {
                throw new UnsatisfiedAttributeValueException(
                        "password is required.", "validation.error.password.size", new Object[] {5, 257});
            }
        }
    }

    /**
     * Payload for changing a user's password.
     *
     * @param password new password
     */
    record ChangePasswordRequest(
            @Schema(requiredMode = REQUIRED, minLength = 5) String password) {}

    Mono<ServerResponse> me(ServerRequest request) {
        return ReactiveSecurityContextHolder.getContext()
                .map(SecurityContext::getAuthentication)
                .filter(Authentication::isAuthenticated)
                .flatMap(auth -> userService.getUser(auth.getName()).flatMap(user -> {

View on GitHub (pinned to d2f5165f9c)

Solutions

1. Submit a new password whose length is between 5 and 257 inclusive.
2. Enforce the same 5–257 bounds in the client UI before enabling submit.
3. Localize the response using code 'validation.error.password.size' with args [5,257].

Example fix

// before:  { "oldPassword": "x", "password": "123" }
// after:   { "oldPassword": "x", "password": "strong-pass-42" }

// enforce 5..257 length before the request
String p = newPassword;
if (p == null || p.length() < 5 || p.length() > 257) {
    showUserError("Password must be 5–257 characters");
    return;
}

When it happens

Trigger: POST to change the current user's own password (console endpoint) with a 'password' that is null, has length < 5, or length > 257. The compact constructor validates before Spring's binding validation runs.

Common situations: User submits an empty new password; password generator produced a >257 char token; frontend sent only oldPassword; paste error truncated the password to a few chars; test fixture used '123' as a weak password.

Related errors

• validation.error.email.pattern
• validation.error.password.size
• Name is required
• Email is required
• Invalid file type, only jar is supported

AI-assisted analysis of halo-dev/halo@d2f5165f9c (2026-08-14). Data as JSON: /api/errors/a4563ccbe914656d. Report an issue: GitHub.