mattermost-community/focalboard · warning

Invalid password

Error message

Invalid password

What it means

RegisterUser wraps a validation failure from auth.IsPasswordValid as 'Invalid password'. Before creating a user, the supplied password is checked against PasswordSettings (here MinimumLength: 6); a password shorter than the minimum (or otherwise invalid) aborts registration. The wrapped cause contains the specific rule violated.

Source

Thrown at server/app/auth.go:178

	if user == nil && email != "" {
		var err error
		user, err = a.store.GetUserByEmail(email)
		if err != nil && !model.IsErrNotFound(err) {
			return err
		}
		if user != nil {
			return errors.New("The email already exists")
		}
	}

	// TODO: Move this into the config
	passwordSettings := auth.PasswordSettings{
		MinimumLength: 6,
	}

	err := auth.IsPasswordValid(password, passwordSettings)
	if err != nil {
		return errors.Wrap(err, "Invalid password")
	}

	_, err = a.store.CreateUser(&model.User{
		ID:          utils.NewID(utils.IDTypeUser),
		Username:    username,
		Email:       email,
		Password:    auth.HashPassword(password),
		MfaSecret:   "",
		AuthService: a.config.AuthMode,
		AuthData:    "",
	})
	if err != nil {
		return errors.Wrap(err, "Unable to create the new user")
	}

	return nil
}

View on GitHub (pinned to a84bbb65e3)

Solutions

1. Enforce the minimum length (6) client-side before calling RegisterUser
2. Read errors.Cause(err) to show the user the exact rule violated
3. Trim/handle whitespace and empty passwords in the input form
4. Keep client-side password policy in sync with server PasswordSettings

Example fix

// before
password := r.FormValue("password")
err := app.RegisterUser(username, email, password)
// after
password := strings.TrimSpace(r.FormValue("password"))
if len(password) < 6 {
    return errors.New("password must be at least 6 characters")
}
err := app.RegisterUser(username, email, password)

const minPasswordLength = 6
func passwordOK(p string) bool {
    return len(strings.TrimSpace(p)) >= minPasswordLength
}
// call before RegisterUser:
if !passwordOK(password) {
    return errors.New("password must be at least 6 characters")
}

func isPasswordInvalidErr(err error) bool {
    return strings.Contains(err.Error(), "Invalid password")
}

if err := app.RegisterUser(username, email, password); err != nil {
    if strings.Contains(err.Error(), "Invalid password") {
        return fmt.Errorf("password rejected: %v", errors.Cause(err))
    }
    return err
}

When it happens

Trigger: App.RegisterUser(username, email, password) called with a password shorter than 6 characters (or failing any other IsPasswordValid rule), with unique username/email already verified.

Common situations: Signup form with missing/weak client-side validation; empty password field; API client bypassing the UI; password with leading/trailing whitespace mishandled; requirements changed between client and server versions.

Related errors

• no user ID
• No User IDs
• The username already exists
• The email already exists
• block fields size limit exceeded

AI-assisted analysis of mattermost-community/focalboard@a84bbb65e3 (2026-08-30). Data as JSON: /api/errors/2e9ce8a14cab9c43. Report an issue: GitHub.