full-stack-fastapi-template icon indicating copy to clipboard operation
full-stack-fastapi-template copied to clipboard

♻️ Update password max length

Open michaelAlvarino opened this issue 11 months ago • 3 comments

On my machine, the command provided to generate a password (using python3 specifically), results in a 44 character string, while the maximum allowable character length in the model is 40, causing a conflict. This PR updates the max_legnth for all password model definitions.

MacBook-Pro-3:full-stack-fastapi-template michaelalvarino$ python3 -c "import secrets; print(secrets.token_urlsafe(32))" | wc -c
      44
MacBook-Pro-3:full-stack-fastapi-template michaelalvarino$ python3 -c "import secrets; print(secrets.token_urlsafe(32))" | wc -c
      44
MacBook-Pro-3:full-stack-fastapi-template michaelalvarino$ python3 -c "import secrets; print(secrets.token_urlsafe(32))" | wc -c
      44

michaelAlvarino avatar Dec 11 '24 03:12 michaelAlvarino

I had the same issue on first time run of a plain clone of the project: I generated the passwords as recommended with the provided python code which led to the prestart container failing with the ValidationError (password - "String should have at most 40 characters").

I'd suggest to raise the limit to something around 100 characters at least, to encourage strong password best practices, such as using passphrases (a 100 bit entropy passphrase with 8 words can easily have around 70 characters).

sheep7 avatar Apr 18 '25 20:04 sheep7

Hello @michaelAlvarino,

this is my inner Monk writing :-D - Is there a reason to set the password length to 45 or could it be 48 or 64? Because you can divided 48 or 64 by two^^.

stevleibelt avatar Apr 19 '25 08:04 stevleibelt

This was a while ago, so I think it was because I was looking for the cutoff point at which everything worked. So no reason in particular. I'll change it to ~64~ 128.

michaelAlvarino avatar Apr 21 '25 14:04 michaelAlvarino

@YuriiMotov I needed to regenerate the client, could I get another 👍 ?

michaelAlvarino avatar Sep 20 '25 14:09 michaelAlvarino