full-stack-fastapi-template icon indicating copy to clipboard operation
full-stack-fastapi-template copied to clipboard

Add note about `FIRST_SUPERUSER_PASSWORD` needing to be 40 characters or less

Open tylermilner opened this issue 5 months ago • 0 comments

The value of the FIRST_SUPERUSER_PASSWORD environment variable needs to be <= 40 characters or else the prestart logic will fail with a "String should have at most 40 characters" error. See below prestart output when launching using docker compose up and a FIRST_SUPERUSER_PASSWORD that's > 40 characters:

prestart-1     | INFO:__main__:Initializing service
prestart-1     | INFO:__main__:Starting call to '__main__.init', this is the 1st time calling it.
prestart-1     | INFO:__main__:Service finished initializing
prestart-1     | + alembic upgrade head
prestart-1     | INFO  [alembic.runtime.migration] Context impl PostgresqlImpl.
prestart-1     | INFO  [alembic.runtime.migration] Will assume transactional DDL.
prestart-1     | INFO  [alembic.runtime.migration] Running upgrade  -> e2412789c190, Initialize models
prestart-1     | INFO  [alembic.runtime.migration] Running upgrade e2412789c190 -> 9c0a54914c78, Add max length for string(varchar) fields in User and Items models
prestart-1     | INFO  [alembic.runtime.migration] Running upgrade 9c0a54914c78 -> d98dd8ec85a3, Edit replace id integers in all models to use UUID instead
prestart-1     | INFO  [alembic.runtime.migration] Running upgrade d98dd8ec85a3 -> 1a31ce608336, Add cascade delete relationships
prestart-1     | + python app/initial_data.py
prestart-1     | INFO:__main__:Creating initial data
prestart-1     | Traceback (most recent call last):
prestart-1     |   File "/app/app/initial_data.py", line 23, in <module>
prestart-1     |     main()
prestart-1     |   File "/app/app/initial_data.py", line 18, in main
prestart-1     |     init()
prestart-1     |   File "/app/app/initial_data.py", line 13, in init
prestart-1     |     init_db(session)
prestart-1     |   File "/app/app/core/db.py", line 28, in init_db
prestart-1     |     user_in = UserCreate(
prestart-1     |   File "/app/.venv/lib/python3.10/site-packages/sqlmodel/main.py", line 814, in __init__
prestart-1     |     sqlmodel_init(self=__pydantic_self__, data=data)
prestart-1     |   File "/app/.venv/lib/python3.10/site-packages/sqlmodel/_compat.py", line 351, in sqlmodel_init
prestart-1     |     self.__pydantic_validator__.validate_python(
prestart-1     | pydantic_core._pydantic_core.ValidationError: 1 validation error for UserCreate
prestart-1     | password
prestart-1     |   String should have at most 40 characters [type=string_too_long, input_value='<REDACTED>', input_type=str]
prestart-1     |     For further information visit https://errors.pydantic.dev/2.9/v/string_too_long

I ran into this after following the instructions in deployment.md to generate secret keys using this command:

python -c "import secrets; print(secrets.token_urlsafe(32))"

I know that FIRST_SUPERUSER_PASSWORD isn't technically a "key", but it does have a default value of changethis in .env, so it was assumed it should be safe to just go ahead and use the above command to generate a secure password for it.

This PR adds notes about the FIRST_SUPERUSER_PASSWORD needing to be <= 40 characters to the documentation.

Optionally, we could also update the above Python snippet to produce 40 character secrets by default, which would further help mitigate the issue:

- python -c "import secrets; print(secrets.token_urlsafe(32))"
+ python -c "import secrets; print(secrets.token_urlsafe(30))"

Let me know if we also want to make that update.

tylermilner avatar Jun 19 '25 14:06 tylermilner