Refuse passwords over 72 bytes and confirm only stored ones (closes #144) #173

Merged

clawbot merged 1 commits from issue-144-password-length into next

2026-10-21 05:02:01 +02:00

Author	SHA1	Message	Date
sneak	fba2ab960e	Refuse passwords over 72 bytes and confirm only stored ones (closes #144 ) check / check (push) Waiting to run Details bcrypt cannot hash a password longer than 72 bytes. PASS over the HTTP API answered one with a 500, and the IRC listener confirmed it without storing it. Both transports now refuse a password outside 8 to 72 bytes with the reply a short one already got: 461 over the HTTP API, a NOTICE over the IRC listener. setPassword returns its error, and "Password set" is sent only when the password was stored. A PASS given before registration, an empty one included, is checked after the welcome burst and gets the same NOTICE. Model: opus-5-5	2026-10-21 02:27:16 +00:00

Author

SHA1

Message

Date

sneak

fba2ab960e

Refuse passwords over 72 bytes and confirm only stored ones (closes #144 )

check / check (push) Waiting to run

Details

bcrypt cannot hash a password longer than 72 bytes. PASS over the HTTP
API answered one with a 500, and the IRC listener confirmed it without
storing it.

Both transports now refuse a password outside 8 to 72 bytes with the
reply a short one already got: 461 over the HTTP API, a NOTICE over the
IRC listener. setPassword returns its error, and "Password set" is sent
only when the password was stored. A PASS given before registration, an
empty one included, is checked after the welcome burst and gets the
same NOTICE.

Model: opus-5-5

2026-10-21 02:27:16 +00:00