-
-
Notifications
You must be signed in to change notification settings - Fork 7.3k
♻️ Update password max length #1447
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
On my machine, the command provided to generate a password (using python3 specifically), results in a 44 character string, while the maximum allowable character length in the model is 40, causing a conflict. This PR updates the max_legnth for all password model definitions. ``` MacBook-Pro-3:full-stack-fastapi-template michaelalvarino$ python3 -c "import secrets; print(secrets.token_urlsafe(32))" | wc -c 44 MacBook-Pro-3:full-stack-fastapi-template michaelalvarino$ python3 -c "import secrets; print(secrets.token_urlsafe(32))" | wc -c 44 MacBook-Pro-3:full-stack-fastapi-template michaelalvarino$ python3 -c "import secrets; print(secrets.token_urlsafe(32))" | wc -c 44 ```
I had the same issue on first time run of a plain clone of the project: I generated the passwords as recommended with the provided python code which led to the I'd suggest to raise the limit to something around 100 characters at least, to encourage strong password best practices, such as using passphrases (a 100 bit entropy passphrase with 8 words can easily have around 70 characters). |
Hello @michaelAlvarino, this is my inner Monk writing :-D - Is there a reason to set the password length to 45 or could it be 48 or 64? Because you can divided 48 or 64 by two^^. |
This was a while ago, so I think it was because I was looking for the cutoff point at which everything worked. So no reason in particular. I'll change it to |
Further increase password length limit to address concerns around password entropy and make it multiple of 2.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If people need this, why not?
LGTM
@YuriiMotov I needed to regenerate the client, could I get another 👍 ? |
On my machine, the command provided to generate a password (using
python3 specifically), results in a 44 character string, while the
maximum allowable character length in the model is 40, causing a
conflict. This PR updates the max_legnth for all password model
definitions.
Discussion: #1448