forwardemail/forwardemail.net

[fix] Impossibly strong password requirements.

Closed this issue · 8 comments

RokeJulianLockhart commented

Describe the bug

Node.js version:

OS version:

cpe:/o:opensuse:tumbleweed:20230813

Description:

I generated a password using Bitwarden comprised of 128 characters and non-ASCII Unicode. This was apparently inadequate to register with.

Actual behavior

image

You're kidding, right?

Expected behavior

Code to reproduce

Checklist

  • I have searched through GitHub issues for similar issues.
  • I have completely read through the README and documentation.
  • I have tested my code with the latest version of Node.js and this package and confirmed it is still not working.
titanism commented

Oh my, thank you @RokeJulianLockhart for letting us know- this must be a bug in underlying library. We will take a look.

  • ❤️1
RokeJulianLockhart commented

No, thank you, @titanism, for finding this so quickly. I see you take your requirements from https://neal.fun/password-game/

titanism commented

Didn't mean to mark that off topic , meant to do the laugh emoji on it 😆 haha that was definitely not intentional, but that link is hilarious! Fixing now.

titanism commented

@RokeJulianLockhart FIXED! Try again? See cb766ef (🤦) - apologies about that! Hope to see you as a customer 🔜

  • ❤️1
RokeJulianLockhart commented

@titanism, have you checked cb766ef against an arbitrary long password (like 32,767 characters)? I used to use 1024, and it sometimes caused undefined behaviour. No limit is absolutely brilliant, just check you can handle it.

titanism commented

The limit is the current MongoDB doc length of 16mb https://stackoverflow.com/a/10827837

  • 👍1
RokeJulianLockhart commented

So it would show the same error and reject it?

titanism commented

You'd get an error like "DocumentTooLarge: BSON document too large" but we would mask that to "Internal Server Error" client-side.

  • 👍1