# \[Bug\] system.security.validateUser makes user lose access when password is blank

**URL:** <https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495>\
**Category:** Ignition\
**Tags:** ignition81, scripting\
**Created:** [November 26, 2021, 4:07pm UTC](https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495 "2021-11-26T16:07:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pedropalmeira68](https://avatars.discourse-cdn.com/v4/letter/p/f07891/32.png) [@pedropalmeira68](https://forum.inductiveautomation.com/u/pedropalmeira68)\
**Post date:** [November 26, 2021, 4:07pm UTC](https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495/1 "2021-11-26T16:07:31Z")

</div>

When executing system.security.validateUser with password parameter blank, the user loses access.

Example:

[https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/c/4c7acf0185d393ac2fc86396f0dbaa6b4289e55c.mp4](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/c/4c7acf0185d393ac2fc86396f0dbaa6b4289e55c.mp4)

Ignition 8.1.5

---

<div class="post-metadata">

**Author:** ![jespinmartin1](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jespinmartin1/32/57175_2.png) [@jespinmartin1](https://forum.inductiveautomation.com/u/jespinmartin1)\
**Post date:** [November 26, 2021, 10:35pm UTC](https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495/2 "2021-11-26T22:35:32Z")

</div>

What if you secure the password field checking if password is blank.

```auto
password = '1234'
validate = False
if password.strip() != '':
     validate = system.security.validateUser('user',password)

```

---

<div class="post-metadata">

**Author:** ![pedropalmeira68](https://avatars.discourse-cdn.com/v4/letter/p/f07891/32.png) [@pedropalmeira68](https://forum.inductiveautomation.com/u/pedropalmeira68)\
**Post date:** [November 27, 2021, 1:54am UTC](https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495/3 "2021-11-27T01:54:02Z")

</div>

Yes… but it’s kind of dangerous for those who don’t know, i had tested it with my designer account and lost it, on our server we only have access to the designer, someone can get locked in the future

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [November 29, 2021, 4:34pm UTC](https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495/4 "2021-11-29T16:34:51Z")

</div>

I don’t think the use of a blank password made you “lose access”. What probably happened is: you triggered the validateUser scripting function with the incorrect credentials too many times and triggered a lockout for that user. See lockout settings described here: [Classic Authentication Strategy - Ignition User Manual 8.1 - Ignition Documentation](https://docs.inductiveautomation.com/display/DOC81/Classic+Authentication+Strategy#ClassicAuthenticationStrategy-MainProperties)

In your Gateway logs, do you see any messages like `User 'Teste01' is locked out` or `User 'Teste01' is now locked out`? Especially around the time where you think you lost access? That would confirm my theory…

---

<div class="post-metadata">

**Author:** ![pedropalmeira68](https://avatars.discourse-cdn.com/v4/letter/p/f07891/32.png) [@pedropalmeira68](https://forum.inductiveautomation.com/u/pedropalmeira68)\
**Post date:** [November 30, 2021, 11:00am UTC](https://forum.inductiveautomation.com/t/bug-system-security-validateuser-makes-user-lose-access-when-password-is-blank/53495/5 "2021-11-30T11:00:57Z")

</div>

It seems like it was a coincidence, every time i get locked out was after I had tested the blank password, but before that I had tested the theory of failing many times, maybe I still hadn’t reached the limit and the blank password was the last one

as you said, on the gateway:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/9/59a163761ba59a139e7e08b6efffe581b20ae70f.png)