From f26425e9fa4551314050b55247b4700cf35ee624 Mon Sep 17 00:00:00 2001 From: denis0001-dev Date: Tue, 7 Apr 2026 22:07:04 +0300 Subject: [PATCH] Change change password error code to 400 to avoid automatic logout --- backend/services/main/routes/account.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/services/main/routes/account.py b/backend/services/main/routes/account.py index 16b53a1..1336a99 100644 --- a/backend/services/main/routes/account.py +++ b/backend/services/main/routes/account.py @@ -441,7 +441,8 @@ def change_password( ): # Verify current derived password against stored hash if not verify_password(password_request.currentPasswordDerived.strip(), current_user.password_hash): - raise HTTPException(status_code=401, detail="Текущий пароль неверный") + # 400 (not 401): mobile client treats 401 as global auth failure and clears the session. + raise HTTPException(status_code=400, detail="Текущий пароль неверный") # Update password hash to hash of new derived password current_user.password_hash = get_password_hash(password_request.newPasswordDerived.strip())