check current password before updating user password

[zakaria-chahboun]

I want this behaviour like in this image bellow:

Checking the current password before the update process

The available choice is:

const { user, error } = await supabase.auth.update({ password:  newPassword});

With this code anyone has opened the user profile page can update the password!
I'm thinking to do this step by a RPC function, But how i can check the current user password? Cuze it's encrypted by an algorithm!

[oscarrc]

I think the intended way to change a password is with a reset password email

[zakaria-chahboun]

Yeah - but this is not the case we have here!

[zakaria-chahboun]

I did this 👇 as a RPC function

create or replace function change_user_password(current_plain_password varchar, new_plain_password varchar)
returns json
language plpgsql
security definer
as $$
DECLARE
_uid uuid; -- for checking by 'is not found'
user_id uuid; -- to store the user id from the request
BEGIN
  -- First of all check the new password rules
  -- not empty
  IF (new_plain_password = '') IS NOT FALSE THEN
    RAISE EXCEPTION 'new password is empty';
  -- minimum 6 chars
  ELSIF char_length(new_plain_password) < 6 THEN
    RAISE EXCEPTION 'it must be at least 6 characters in length';
  END IF;
  
  -- Get user by his current auth.uid and current password
  user_id := auth.uid();
  SELECT id INTO _uid
  FROM auth.users
  WHERE id = user_id
  AND encrypted_password =
  crypt(current_plain_password::text, auth.users.encrypted_password);

  -- Check the currect password
  IF NOT FOUND THEN
    RAISE EXCEPTION 'incorrect password';
  END IF;

  -- Then set the new password
  UPDATE auth.users SET 
  encrypted_password =
  crypt(new_plain_password, gen_salt('bf'))
  WHERE id = user_id;
  
  RETURN '{"data":true}';
END;
$$

I got this error: { "hint": null, "message": "invalid salt", "code": "22023", "details": null}

But when trying these lines in the supabase sql editor:

  SELECT id
  FROM auth.users
  WHERE id = 'THE-USER-ID'
  AND encrypted_password =
  crypt('THE-USER-PASSWORD'::text, auth.users.encrypted_password);
  
  -- And
  
  UPDATE auth.users SET 
  encrypted_password =
  crypt('NEW-USER-PASSWORD', gen_salt('bf'))
  WHERE id = 'THE-USER-ID';

The code is run successfully!

WHY?

---

Edit:

The function is working fine, I just moved the auth.uid() to another declared variable user_id, I guess a confusion happened with the first way! You can now use my function directly!

If you got the code:22023 "invalid salt", Now it's mean that your user doesn't logged in! So you can catch it in your app!

[zakaria-chahboun]

very useful, thank you!

you welcome @matheop

[seho0808]

Saved ton of time :) tyvm

[olaberglund]

This just creates another way of changing the password. The supabase client still exists, so the call that corresponds to supabase.auth.update({ password: newPassword}) is still available for the user.

[cenullum]

Could you find a way to stop auth.update ?

[Tranthanh98]

Thanks bro, 2025 and even AI could not help resolve this problem like bro did

[GaryAustin1]

Does your search path include extensions? I ran into this with the http extension. Although your error sort of implies it found the crypt function....

#462

[zakaria-chahboun]

@GaryAustin1
I added these paths to my function SET search_path = extensions, public, auth
but without any solution! still the same error message.

[GaryAustin1]

It might be the user who created the function does not have access to the auth schema. Crypt would probably fail with that salt error if auth.user.encrypted_password can't be accessed.

The SQL console is run as superuser. This would let queries work standalone. Security Definer on the function means it runs with permissions of the creator. Did you create the function in the SQL console or elsewhere?

I'm not sure if Supabase has any other sort of protection on auth.user as in general they don't want you accessing it (hence the auth.uid() type functions), but you were able to use it as superuser in sql console so don't think so.

[zakaria-chahboun]

Yes i create the function in the SQL console and i have already the Security Define on it.

[GaryAustin1]

Well I guess make sure current_plain_password is what you expect in the function(hard code it as a test). I don't see any other differences. Not sure that being null or something odd would generate a salt error though.

[GaryAustin1]

@zakaria-chahboun Since I was considering using something like you have, I tested it out.
It works fine with an rpc call of:

.rpc('change_user_password', { 'current_plain_password': "Sblgfsjgrijg", 'new_plain_password': 'lflflfllflflllf' })

I created it in the sql editor window on Supabase UI.

For what it is worth my search_path for the sql user is: ""$user", public, auth, extensions" although I'm skeptical that matters.

Edit: Did you by chance first create the function in the database page of the UI initially? I don't think create/replace changes the original owner and I believe that is a different user there.

[zakaria-chahboun]

What is the $user" search_path?

• Did you by chance first create the function in the database page of the UI initially?
• No!

But i have a developer permission on a project. I'm not the owner! But all things is worked fine for me except this function!

• I as i said the code works for me in the SQL edior! But inside the function no!

[GaryAustin1]

Well your function runs correctly for me as is. I can force the salt error by putting a ‘’ where the auth.users.encrypted_password is. That column appears to be unreadable for you which seems like permission or path issue. Maybe alter function name owner as supabase_admin or run code with a new function name to make sure you really set it up in the sql editor in the ui the very first time.

show search_path should show you the sql window owners search path.

edit: Is it possible you have a "bad" encrypted_password in your auth table from experimenting?

[GaryAustin1]

Deleted. Sorry this extra reply was a bad idea.

[zakaria-chahboun]

I changed the auth.uid() with my user uid directly into the function, And it's worked fine!
So the problem here is i can't get the user UID from the auth.uid(). I guess that because of the security definer or what?

Edit:
I checked the auth.uid() and it gives me my user uid correctly!!

  -- login check
    RAISE EXCEPTION 'you must login'
    using detail = 'UID: ' || auth.uid();

Edit:
Finally it's worked fine by moving the auth.uid() to another declared variable! I guess that's happens because of confusion or somthing! + Whiteout any search_path!

[GaryAustin1]

Very strange as it works for me just copying your code at the start. Oh well.

[abdulrahimiliasu]

In case someone is looking for a quick solution here it is.

This returns true if the password entered by the current user is correct and false otherwise.

CREATE OR REPLACE FUNCTION verify_user_password(password text)
RETURNS BOOLEAN SECURITY DEFINER AS
$$
BEGIN
  RETURN EXISTS (
    SELECT id 
    FROM auth.users 
    WHERE id = auth.uid() AND encrypted_password = crypt(password::text, auth.users.encrypted_password)
  );
END;
$$ LANGUAGE plpgsql;

[gauravkaliadev]

Thanks for providing this solution, exactly what I was looking for however I am not able to make it work and getting below error, please help.

Unhandled Exception: PostgrestException(message: function crypt(text, character varying) does not exist, code: 42883, details: Not Found, hint: No function matches the given name and argument types. You might need to add explicit type casts.)

[gauravkaliadev]

Adding SET search_path = extensions, public, auth worked for me.

[kei-kusanagi]

Sorry for my ignorance, I'm somewhat new to this supabase thing. Where exactly in the function do you put SET search_path?

[gauravkaliadev]

@kei-kusanagi try it like this

.... SECURITY DEFINER SET search_path = extensions, public, auth AS ....

[craxrev]

I'd leave this information for anyone who might had faced the code:22023 "invalid salt" error..

In my case, it was because the user I'm connected with does not have his password set yet, because he's signed up using a provider (google in my case)

[Sisableng]

i got same problem

[STIAANWOL]

What were your solutions for this @craxrev and @Sisableng ?

[Sisableng]

@STIAANWOL Currently, I haven't found the solution yet, but for the time being, I am changing the password update verification method to random questions or personal questions like "what was your childhood nickname?"

[bayramorhan]

Well, here is another approach if you dont want to deal with the "rpc" or sql stuff. (User must be logged-in)

const user = useSupabaseUser()
const client = useSupabaseClient()
const currentPassword = ref("")
const newPassword = ref("")

// handle change password
const handleChangePassword = async () => {
// try to login with the given credentials even the user is already logged-in
const { data, error } = await client.auth.signInWithPassword({
			email: user.value.email, // email from current session
			password: currentPassword.value
		})

		if (data?.user?.id) { // current password is valid
			await client.auth.updateUser({
				password: newPassword.value
			})
			alert("Your password is changed")
		} else { / / handle current pass is not valid. you can force the user to re-log at this point because the current session is dead after failed attempt.
alert("Your current password is not valid. For safety concerns, you need to re-log")
}
})

[nmerchant]

This solution sort of works, however if the user types their password in wrong, it immediately log them out - so not sure it's the best solution for an account settings page, for example.

[josiext]

Well, here is another approach if you dont want to deal with the "rpc" or sql stuff. (User must be logged-in)

const user = useSupabaseUser()
const client = useSupabaseClient()
const currentPassword = ref("")
const newPassword = ref("")

// handle change password
const handleChangePassword = async () => {
// try to login with the given credentials even the user is already logged-in
const { data, error } = await client.auth.signInWithPassword({
			email: user.value.email, // email from current session
			password: currentPassword.value
		})

		if (data?.user?.id) { // current password is valid
			await client.auth.updateUser({
				password: newPassword.value
			})
			alert("Your password is changed")
		} else { / / handle current pass is not valid. you can force the user to re-log at this point because the current session is dead after failed attempt.
alert("Your current password is not valid. For safety concerns, you need to re-log")
}
})

This works well for me. It doesn't logout user if the current password is wrong

[imjamesburns]

I was successfully using abdulrahimiliasu's solution above, until I migrated from @supabase/auth-helpers-nextjs to @supabase/ssr. At that point I started getting the {code: '22023', message: 'invalid salt'} error.

Unsure how that broke it, but found declaring the auth.uid first has fixed it.

CREATE SUPABASE FUNCTION:

SET search_path = extensions, public, auth;

CREATE OR REPLACE FUNCTION public.verify_user_password(password text)
RETURNS BOOLEAN SECURITY DEFINER AS
$$
DECLARE
  user_id uuid;
BEGIN
  user_id := auth.uid();
  RETURN EXISTS (
    SELECT id 
    FROM auth.users 
    WHERE id = user_id AND encrypted_password = crypt(password::text, auth.users.encrypted_password)
  );
END;
$$ LANGUAGE plpgsql;

NEXT.JS:

import { createBrowserClient } from '@supabase/ssr';

export default function UpdatePasswordForm() {
  const supabase = createBrowserClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
  );

  async function updatePassword(oldPassword, newPassword) {
    // Verify the current password
    const verifyResponse = await supabase.rpc('verify_user_password', { password: oldPassword });
    if (verifyResponse.error) {
      console.error(verifyResponse.error);
      return false;
    }

    // Update to the new password if the old one is correct
    if (verifyResponse.data === true) {
      const updateResponse = await supabase.auth.updateUser({ password: newPassword });
      return !updateResponse.error;
    }
    
    return false;
  }

  return <></>;
}

[Donnerstagnacht]

@kiwicopple wouldn't this be a nice feature for the supabase Auth library? To add a functionality for an optional parameter "oldPassword" to the "auth.updateUser()" function?

Actually, there is already a feature request for this: https://github.com/orgs/supabase/discussions/18820
Vote it up if you would like to have that feature, too! :)

[cenullum]

to disable previous method auth.update(email) and making only way to update with rpc function above :

CREATE OR REPLACE FUNCTION public.check_password() RETURNS TRIGGER AS $$
BEGIN
raise log 'current_user: %',current_user;
  if current_user = 'supabase_auth_admin' then
    raise exception 'Updates to password column not allowed for supabase_auth_admin';
  end if;
  RETURN NEW;
END;
$$ language plpgsql
security invoker;



CREATE or replace TRIGGER on_password_updated
BEFORE UPDATE OF encrypted_password ON auth.users
FOR EACH ROW
EXECUTE PROCEDURE public.check_password();

[hoomanaskari]

If you wanna have more control over this workflow, you could use the following rpc that only confirms the current password. You can run the rest of the flow using the SDK

CREATE
OR REPLACE FUNCTION confirm_current_user_password (current_plain_password TEXT) RETURNS json LANGUAGE plpgsql SECURITY DEFINER AS $$ 
DECLARE 
    user_id uuid; 
BEGIN 
    user_id := auth.uid(); 
    
    IF NOT EXISTS (
        SELECT 1 
        FROM auth.users 
        WHERE id = user_id 
        AND encrypted_password = crypt(current_plain_password::text, auth.users.encrypted_password)
    ) THEN 
        RAISE EXCEPTION 'incorrect password'; 
    END IF; 
    
    RETURN '{"data":true}'; 
END; 
$$;

[teknology]

I wish Supabase had a verified password method for those more secure platforms. An RPC can be missed during the launch of a new platform, complicating what should be pretty straightforward.

[cjxe]

Unfortunately this method is not secure since the client can still call updateUser without requiring to enter their current password

[olaberglund]

Already mentioned.