diff --git a/srcs/requirements/nestjs/api_back/src/chat/chat.controller.ts b/srcs/requirements/nestjs/api_back/src/chat/chat.controller.ts
index 82b0a21b..4308c4cc 100644
--- a/srcs/requirements/nestjs/api_back/src/chat/chat.controller.ts
+++ b/srcs/requirements/nestjs/api_back/src/chat/chat.controller.ts
@@ -111,7 +111,8 @@ export class ChatController {
 		if (test_regex.test(room.name) === false)
 		{
 			let forbidden_chars = room.name.replace(new RegExp(regex_base, "g"), "");
-			throw new HttpException(`Your room name can not contains these characters : ${forbidden_chars}`, HttpStatus.UNPROCESSABLE_ENTITY);
+			console.log(`throw error: Your room name can not contains these characters : ${forbidden_chars}`);
+			throw new HttpException( `Your room name can not contains these characters : ${forbidden_chars}`, HttpStatus.UNPROCESSABLE_ENTITY);
 		}
 
 		if (!room.password || room.password.length === 0)
@@ -119,7 +120,6 @@ export class ChatController {
 		else
 			room.protection = true;
 		room.users = [req.user.username];
-		room.owner = req.user.username;
 		await this.chatService.addUserToNewRoom(req.user.username, room);
 
 		const ret_room = this.format_room(room);
@@ -151,17 +151,17 @@ export class ChatController {
 			if (room_db.type === 'direct')
 			{
 				console.log("throw error: cannot join a direct messages room");
-				throw new HttpException(`cannot join a direct messages room`, HttpStatus.CONFLICT);
+				throw new HttpException( `cannot join a direct messages room`, HttpStatus.CONFLICT);
 			}
 			if (room_db.type === 'private')
 			{
 				console.log("throw error: cannot join a private room");
-				throw new HttpException(`cannot join a private room`, HttpStatus.CONFLICT);
+				throw new HttpException( `cannot join a private room`, HttpStatus.CONFLICT);
 			}
 			if (room_db.users.includes(req.user.username))
 			{
 				console.log("throw error: your have already joined this room");
-				throw new HttpException(`your have already joined this room`, HttpStatus.CONFLICT);
+				throw new HttpException( `your have already joined this room`, HttpStatus.CONFLICT);
 			}
 			room = await this.chatService.addUserToRoom(req.user.username, room.name);
 		}
@@ -182,6 +182,19 @@ export class ChatController {
 	{
 		console.log("- in changeRoom controller");
 
+		let fields = ["protection", "allowed_users"];
+		const room_db = await this.chatService.getRoomByName(room.name, fields);
+		if (room_db.protection === true)
+		{
+			if (!room.password)
+			{
+				console.log("throw error: code: 'PASSWORD_MISSING', message: 'this room is protected, you need to provide a password'");
+				throw new HttpException({ code: 'PASSWORD_MISSING', message: `this room is protected, you need to provide a password` }, HttpStatus.BAD_REQUEST);
+			}
+			if (!room_db.allowed_users.contains(req.user.username))
+				await this.chatService.setPasswordValidation(req.user.username, room);
+		}
+
 		await this.chatService.setCurrentRoom(req.user.username, room.name);
 		let socket: socketDto = this.chatGateway.sockets.get(req.user.username);
 		await this.chatService.socketChangeRoom(socket, room.name);
diff --git a/srcs/requirements/nestjs/api_back/src/chat/chat.service.ts b/srcs/requirements/nestjs/api_back/src/chat/chat.service.ts
index 2e535d3f..18763305 100644
--- a/srcs/requirements/nestjs/api_back/src/chat/chat.service.ts
+++ b/srcs/requirements/nestjs/api_back/src/chat/chat.service.ts
@@ -199,6 +199,24 @@ export class ChatService {
 		return `room "${room_name}" is now current room`;
 	}
 
+	async setPasswordValidation(username: string, room: roomDto): Promise<void>
+	{
+		console.log("-- in setPasswordValidation service");
+
+		const room_db = await this.getRoomByName(room.name);
+		const is_match = await bcrypt.compare(room.password, room_db.hash);
+		if (!is_match)
+		{
+			console.log(`throw error: code: 'BAD_PASSWORD', message: 'bad password'`);
+			throw new HttpException({ code: 'BAD_PASSWORD', message: `bad password` }, HttpStatus.UNAUTHORIZED);
+		}
+
+		room_db.allowed_users.push(username);
+		await this.chatroomRepository.save(room_db);
+
+		console.log("-- out setPasswordValidation service");
+	}
+
 
 	/* ADDERS *************************************************
 	*/
@@ -211,12 +229,17 @@ export class ChatService {
 		if (find_room)
 		{
 			console.log("throw error: This room name already exist");
-			throw new HttpException(`This room name already exist`, HttpStatus.CONFLICT);
+			throw new HttpException( `This room name already exist`, HttpStatus.CONFLICT);
 		}
 
 		let hash;
 		if (room.protection)
 		{
+			if (room.type === 'direct')
+			{
+				console.log("throw error: code: 'DIRECT_PASSWORD_FORBIDDEN', message: 'you cannot set a password in a direct message room'");
+				throw new HttpException({ code: 'DIRECT_PASSWORD_FORBIDDEN', message: `you cannot set a password in a direct message room`}, HttpStatus.CONFLICT);
+			}
 			const saltOrRounds = 10;
 			const password = room.password;
 			hash = await bcrypt.hash(password, saltOrRounds);
@@ -226,11 +249,16 @@ export class ChatService {
 		let newChatroom = new Chatroom();
 		newChatroom.name = room.name;
 		newChatroom.type = room.type;
-		newChatroom.owner = room.owner;
+		newChatroom.owner = username;
 		newChatroom.users = room.users;
+		newChatroom.allowed_users = [];
 		if (room.protection)
+		{
 			newChatroom.hash = hash;
-		newChatroom.messages = [
+			newChatroom.allowed_users.push(username);
+		}
+		newChatroom.messages =
+		[
 			{ name: "SERVER", message: `creation of room ${room.name}` },
 			{ name: "SERVER", message: `${room.users[0]} joined the room` },
 		];
@@ -284,8 +312,8 @@ export class ChatService {
 		}
 		if (room.type === "direct")
 		{
-			console.log("throw error: you cannot leave a direct messages conversation");
-			throw new HttpException(`you cannot leave a direct messages conversation`, HttpStatus.CONFLICT);
+			console.log("throw error: code: 'LEAVING_DIRECT_FORBIDDEN', message: 'you cannot leave a direct messages conversation'");
+			throw new HttpException({ code: `LEAVING_DIRECT_FORBIDDEN`, message: `you cannot leave a direct messages conversation`, status: HttpStatus.CONFLICT }, HttpStatus.CONFLICT);
 		}
 
 		// delete user from room
diff --git a/srcs/requirements/nestjs/api_back/src/chat/dto/room.dto.ts b/srcs/requirements/nestjs/api_back/src/chat/dto/room.dto.ts
index c6e09176..fb32e7fe 100644
--- a/srcs/requirements/nestjs/api_back/src/chat/dto/room.dto.ts
+++ b/srcs/requirements/nestjs/api_back/src/chat/dto/room.dto.ts
@@ -37,6 +37,11 @@ export class roomDto
 	@IsOptional()
 	users?: string[]; // usernames
 
+	@IsArray()
+	@IsString({ each: true })
+	@IsOptional()
+	allowed_users: string[]; // usernames
+
 	@IsArray()
 	//@IsInstance(messagesDto, { each: true })
 	//@IsObject({ each: true })
diff --git a/srcs/requirements/nestjs/api_back/src/chat/entities/chatroom.entity.ts b/srcs/requirements/nestjs/api_back/src/chat/entities/chatroom.entity.ts
index 02a2bac6..ff59646f 100644
--- a/srcs/requirements/nestjs/api_back/src/chat/entities/chatroom.entity.ts
+++ b/srcs/requirements/nestjs/api_back/src/chat/entities/chatroom.entity.ts
@@ -36,8 +36,12 @@ export class Chatroom
   @Column("simple-array")
 	@IsArray()
 	@IsString({ each: true })
-	@IsOptional()
-	users?: string[]; // usernames
+	users: string[]; // usernames
+
+  @Column("simple-array")
+	@IsArray()
+	@IsString({ each: true })
+	allowed_users: string[]; // usernames
 
   @Column("json")
 	messages: messagesDto[];
diff --git a/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_create.svelte b/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_create.svelte
index f1f7de90..59e4aeb2 100644
--- a/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_create.svelte
+++ b/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_create.svelte
@@ -38,6 +38,8 @@
 			name: room_name,
 			type: room_type,
 		};
+		if (is_protected === true)
+			room.password = room_password;
 		// send the new room
 		response = await create_room(room);
 
diff --git a/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_new.svelte b/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_new.svelte
index 0d2d10b1..c64334c9 100644
--- a/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_new.svelte
+++ b/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_new.svelte
@@ -16,7 +16,10 @@
 		console.log("room:", room);
 		const updated_room = await join_room(room);
 		console.log("updated room:", updated_room);
-		await change_room(updated_room);
+		if (room.protection)
+			layout.set("protected");
+		else
+			await change_room(updated_room);
 	}
 
 </script>
diff --git a/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_protected.svelte b/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_protected.svelte
index a07814b6..0551f91d 100644
--- a/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_protected.svelte
+++ b/srcs/requirements/svelte/api_front/src/pieces/chat/Layout_protected.svelte
@@ -1,10 +1,35 @@
-<script>
+<script lang="ts">
 
-	import { layout } from './Store_chat';
+	import { layout, current_room_name, current_room_type } from './Store_chat';
+	import { change_room } from './Request_rooms';
 	import Button from './Element_button.svelte';
+	import Warning from './Element_warning.svelte';
 
 	export let back = "";
 
+	let room_password: string;
+	let response = {
+		status: 0,
+		message: "",
+	};
+
+	async function handleSubmit(evt)
+	{
+		let formIsValid = evt.target.checkValidity();
+
+		if (!formIsValid)
+			return;
+
+		let room = {
+			name: current_room_name,
+			type: current_room_type,
+			password: room_password,
+		};
+
+		// go to room
+		response = await change_room(room);
+	}
+
 </script>
 
 <div class="grid_box">
@@ -32,6 +57,17 @@
 			<input  id="chat_pswd" type="password" required>
 			<input type="submit" value="&#x2BA1">
 		</form>
+
+		<form on:submit|preventDefault={handleSubmit}>
+			{#if response.status >= 300}
+				<Warning content={response.message}/>
+			{/if}
+			<label for="chat_pswd"><p>enter password :</p></label>
+			<input  id="chat_pswd" bind:value={room_password} type="password" placeholder="minimum 8 characters" minlength="8" name="password" required>
+			<input type="submit" value="&#x2BA1">
+		</form>
+
+
 	</div>
 
 
diff --git a/srcs/requirements/svelte/api_front/src/pieces/chat/Request_rooms.ts b/srcs/requirements/svelte/api_front/src/pieces/chat/Request_rooms.ts
index bd777b16..4a567579 100644
--- a/srcs/requirements/svelte/api_front/src/pieces/chat/Request_rooms.ts
+++ b/srcs/requirements/svelte/api_front/src/pieces/chat/Request_rooms.ts
@@ -76,7 +76,6 @@ export async function change_room(room: Room)
 {
 	console.log("in change_room");
 
-	console.log("room:", room);
 	const response = await fetch('/api/v2/chat/change', {
 		method: 'POST',
 		headers: { 'Content-Type': 'application/json' },
@@ -112,7 +111,10 @@ export async function get_my_rooms()
 	console.log("in get_my_rooms");
 
 	const response = await fetch('/api/v2/chat/myrooms');
+	console.log("response.status", response.status);
 	const data = await response.json();
+	console.log("data:", data);
+
 	let rooms = data.rooms.map(room => set_client_name_on_room(room));
 	console.log("rooms:", rooms);