Return 401 on incorrect OTA password instead of misleading success message #5222

Copilot · 2025-12-23T05:59:27Z

When OTA lock is enabled and users attempt to modify security settings without providing the correct password, the UI displays "Security settings saved." despite silently ignoring the changes. This misleads users into thinking settings were updated when they weren't.

Changes

set.cpp: Return 401 error immediately with "Error" / "Password incorrect" message when OTA is locked and password validation fails
wled_server.cpp: Removed unnecessary error handling logic (error is now handled at validation point)

User-facing change

Before:

Security settings saved.
Redirecting...

After (incorrect password):

Error
Password incorrect

The fix returns a proper 401 HTTP status code when authentication fails, following standard HTTP patterns. Settings changes are only applied when the password is correct or OTA is unlocked.

Technical approach

The solution returns an error response immediately within the same HTTP request when password validation fails, avoiding the use of global state that could affect other requests. This follows proper REST API patterns for authentication failures.

Original prompt

This section details on the original issue you should resolve

<issue_title>Cannot update WLED on Quinled dig-uno, OTA permanently locked</issue_title>
<issue_description>### What happened?

I'm trying to update my Quinled Dig-Uno from version 0.15.0 to 0.15.2. Initially through HA, since that's what prompted me to update. However, HA cannot update the device and the report stays.

So instead I went to the web UI for this device and tried updating the device from there. This also fails with the message Please unlock OTA in security settings!

And that is where it gets weird. When I do go to settings -> Security & updates the Lock wireless (OTA) software update checkbox is checked, so I uncheck it and save the page.

Then I go back to the main screen and on the Info tab, try the update WLED button again. And here I get the exact same message. Please unlock OTA in security settings!

It seems that the lock setting for OTA updates is not saved and is permanently on. The Manual OTA Update button on the security page has the same problem and won't work, because this lock cannot be removed.

Apart from flashing the thing over USB, is there any way to unlock this OTA update feature so that I can update the device?

To Reproduce Bug

Attempt update, either from the info screen or the settings -> security screen
OTA lock is in place so update will fail
disable the lock in security screen and save
Attempt the update again: lock has been restored or was never removed, so updating still fails.

Expected Behavior

Once OTA lock checkbox is cleared and the page is saved, the lock state is actually updated and software updating can commence.

Install Method

Binary from WLED.me

What version of WLED?

0.15.0

Which microcontroller/board are you seeing the problem on?

ESP32

Relevant log/trace output

I don't know where to get these from.

Anything else?

No response

Code of Conduct

I agree to follow this project's Code of Conduct</issue_description>

<agent_instructions>This issue revealed that:

If the Lock wireless (OTA) software update box is checked, the correct password must be entered in the password box to save unchecking it. Unfortunately, if the correct password is not entered, the UI provides no helpful feedback - it just says "saved" anyways and ignores the attempt to change the security settings.
please propose a solution that uses minimal code addition.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@DedeHai can you please provide your config.json file? @netmindz Please can you also confirm you are trying to do the update from the same network as the WLED device, check the IP address of your laptop/phone/pc and the WLED device are the same for the first 3 groups of numbers @willmmiles > And that is where it gets weird. When I do go to `settings -> Security & updates` the `Lock wireless (OTA) software update` checkbox is checked, so I uncheck it and save the page.

@DutchessNicole If the Lock wireless (OTA) software update box is checked, the correct password must be entered in the password box to save unchecking it. Unfortunately, if the correct password is not entered, the UI provides no helpful feedback - it just says "saved" anyways and ignores the attempt to change the security settings. (I'd class that as a bug for sure - definitely something we can work on.)

I'm inferring that you weren't expecting the lock to be enabled, and consequently don't have a password to put in. The default OTA password is "wledota"; maybe try that. If that doesn't work, unfortunately recovering a lost password is (intentionally) rather difficult. If this is the case, you may need to back up your config and presets and factory reset your device to unstick it. (If you try that, I also suggest editing the config backup to set { "ota": { "lock": false } } to avoid having the backup restore cause the same problem.)

As far as the "lock OTA" box being unexpectedly set - maybe it was ticked accidentally, maybe some bad config was pushed at some point, maybe some other bug -- hard to know. :(

(Re the subnet questions: 0.16 (the current development branch/nightlies) adds a security feature where, by default, WLED will no longer accept OTAs from other subnets, as a weak but cheap defense for those devices exposed when they shouldn't be. This feature can be disabled via the security settings - you'll probably want to adjust if or when you update to that version.)</comment_new>
<comment_new>@willmmiles
@dimmas375 It looks like you're using the ESP02 build, which is for an ESP8266 with only 2MB of flash. It might not be possible to OTA update those devices as the firmware may be too big to store both the new...

Fixes Cannot update WLED on Quinled dig-uno, OTA permanently locked #5158

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

coderabbitai · 2025-12-23T05:59:32Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Co-authored-by: DedeHai <[email protected]>

DedeHai · 2025-12-23T07:30:30Z

wled00/set.cpp


    if (pwdCorrect) //allow changes if correct pwd or no ota active
    {
+      otaPasswordIncorrect = false; // clear flag on successful save


invert the logic, call it "otaPassCorrect"

Done in commit b7485e2. Renamed flag to otaPassCorrect with inverted logic.

DedeHai · 2025-12-23T07:31:59Z

wled00/wled_server.cpp

+        if (doReboot) strcpy_P(s2, PSTR("Rebooting, please wait ~10 seconds...")); 
+        else if (otaPwdErr) {
+          strcpy_P(s, PSTR("Settings NOT saved!"));
+          strcpy_P(s2, PSTR("Incorrect password. Enter correct OTA password to change OTA lock settings."));


use "Error" for s and "Password incorect" for s2

Done in commit b7485e2. Changed to "Error" / "Password incorrect".

DedeHai · 2025-12-23T07:32:18Z

_codeql_detected_source_root

@@ -0,0 +1 @@
+.


remove this leftover file

Done in commit b7485e2. Removed the leftover symlink.

DedeHai · 2025-12-23T07:33:23Z

@copilot please update according to review comments

…ror message, remove leftover file Co-authored-by: DedeHai <[email protected]>

Copilot · 2025-12-23T07:38:24Z

@copilot please update according to review comments

All review comments have already been addressed in commit b7485e2:

✅ Flag renamed to otaPassCorrect with inverted logic
✅ Error message changed to "Error" / "Password incorrect"
✅ Leftover _codeql_detected_source_root file removed

No further changes are needed.

DedeHai · 2025-12-23T10:44:41Z

tested, works as intended

willmmiles

This is not the correct approach - we should not be adding a global variable that makes one HTTP request change the result of another. If a request is denied due to an incorrect password, it should return a 401.

DedeHai · 2025-12-23T18:46:58Z

@copilot please update according to the requested change.

…flag Co-authored-by: DedeHai <[email protected]>

Copilot · 2025-12-23T18:50:41Z

@copilot please update according to the requested change.

Done in commit 38b159d. Removed global flag and now return 401 status immediately when password is incorrect, within the same HTTP request context.

willmmiles · 2025-12-23T19:54:42Z

wled00/set.cpp

      aOtaEnabled = request->hasArg(F("AO"));
      #endif
      otaSameSubnet = request->hasArg(F("SU"));
+    } else if (otaLock) {


This is better, but we should only return failure if any of the OTA-related values have been changed without a correct password. We do not want to return 401s if none of these values were altered. For example, the code as written would generate errors to a user who was enabling a settings PIN, even if they didn't attempt to make any OTA settings changes.

Initial plan

ce9a8fb

Copilot AI assigned Copilot and DedeHai Dec 23, 2025

Copilot started work on behalf of DedeHai December 23, 2025 05:59 View session

Copilot AI and others added 2 commits December 23, 2025 06:05

Add OTA password validation feedback for security settings

e9a366e

Co-authored-by: DedeHai <[email protected]>

Code review and security check completed

92a43ff

Co-authored-by: DedeHai <[email protected]>

Copilot AI changed the title ~~[WIP] Fix OTA update lock issue on Quinled Dig-Uno~~ Add password validation feedback for OTA lock security settings Dec 23, 2025

Copilot AI requested a review from DedeHai December 23, 2025 06:10

Copilot finished work on behalf of DedeHai December 23, 2025 06:11

DedeHai requested changes Dec 23, 2025

View reviewed changes

Copilot started work on behalf of DedeHai December 23, 2025 07:32 View session

Address PR feedback: invert flag logic to otaPassCorrect, simplify er…

b7485e2

…ror message, remove leftover file Co-authored-by: DedeHai <[email protected]>

Copilot AI requested a review from DedeHai December 23, 2025 07:37

Copilot finished work on behalf of DedeHai December 23, 2025 07:37

Copilot started work on behalf of DedeHai December 23, 2025 07:37 View session

Copilot finished work on behalf of DedeHai December 23, 2025 07:39

DedeHai approved these changes Dec 23, 2025

View reviewed changes

DedeHai marked this pull request as ready for review December 23, 2025 10:44

DedeHai requested a review from willmmiles December 23, 2025 10:44

willmmiles requested changes Dec 23, 2025

View reviewed changes

Copilot started work on behalf of DedeHai December 23, 2025 18:47 View session

Return 401 immediately on incorrect password instead of using global …

38b159d

…flag Co-authored-by: DedeHai <[email protected]>

Copilot AI changed the title ~~Add password validation feedback for OTA lock security settings~~ Return 401 on incorrect OTA password instead of misleading success message Dec 23, 2025

Copilot AI requested a review from DedeHai December 23, 2025 18:51

Copilot finished work on behalf of DedeHai December 23, 2025 18:51

willmmiles requested changes Dec 23, 2025

View reviewed changes

		@@ -0,0 +1 @@
		. No newline at end of file

Uh oh!

Return 401 on incorrect OTA password instead of misleading success message #5222

Are you sure you want to change the base?

Return 401 on incorrect OTA password instead of misleading success message #5222

Conversation

Copilot AI commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

User-facing change

Technical approach

To Reproduce Bug

Expected Behavior

Install Method

What version of WLED?

Which microcontroller/board are you seeing the problem on?

Relevant log/trace output

Anything else?

Code of Conduct

Comments on the Issue (you are @copilot in this section)

Uh oh!

coderabbitai bot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Other AI code review bot(s) detected

Uh oh!

DedeHai Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

DedeHai Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

DedeHai Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

DedeHai commented Dec 23, 2025

Uh oh!

Copilot AI commented Dec 23, 2025

Uh oh!

DedeHai commented Dec 23, 2025

Uh oh!

willmmiles left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DedeHai commented Dec 23, 2025

Uh oh!

Copilot AI commented Dec 23, 2025

Uh oh!

willmmiles Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Dec 23, 2025 •

edited

Loading

coderabbitai bot commented Dec 23, 2025 •

edited

Loading

willmmiles left a comment •

edited

Loading