Add validation to ensure password length does not exceed 72 bytes

[syobocat]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to report a bug and not ask a question or ask for help

• I have set up AdGuard Home correctly and configured clients to use it. (Use the Discussions for help with installing and configuring clients.)

Platform (OS and CPU architecture)

FreeBSD, AMD64 (aka x86_64)

Installation

GitHub releases or script from README

Setup

On one machine

AdGuard Home version

0.107.38

Action

1. Run installation script
2. Go to xxx.xxx.xxx.xxx:3000 for initial setup
3. Use a password longer than 24 bytes
4. Complete the initial setup

Expected result

Hash of the password get written on the configuration file, and “Sign out” button is shown on the upper right corner of Dashboard

Actual result

users section of the configuration file remains empty, and no “Sign out” button appeared and users can access to Dashboard without authentication

Additional information and/or screenshots

Resetting password works with passwords of any length

* As this is too simple problem, I thought there must be a duplicate issue on GitHub.
However, I couldn’t find it, so I submitted this issue.
Sorry if I just overlooked.

[ainar-g]

I cannot reproduce this, sorry. I'm successfully using 123456789012345678901234567890, which is 30 bytes, as a password.

Can you launch the AGH install with the -v flag to see the verbose messages and perhaps any errors?

[syobocat]

Thank you for your reply.

It seems that Cloudflare’s cache or something prevented me to understand the problem correctly.
Passwords longer than 24 bytes don’t cause the problem as you said, however, passwords longer than 72 bytes do, and it’s obviously because bcrypt doesn’t accept inputs longer than 72 bytes.

So, I think I need to change this issue into a feature request saying “Add validation to ensure password length does not exceed 72 bytes”.

[ainar-g]

Ah, I see, I can reproduce this now. Thanks for the report.

[ainar-g]

This should be fixed on the Edge channel. Could you please check?

[syobocat]

I confirmed that the setup screen rejects passwords longer than 72bytes, on v0.108.0-a.725+5fa11567.
Thank you so much!