NginxProxyManager / NginxProxyManager/nginx-proxy-manager
Postgres password hashing issue
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34.2k
- Forks
- 3.9k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 20
Description
Checklist
- Have you pulled and found the error with
jc21/nginx-proxy-manager:latestdocker image?- Yes
- Are you sure you're not using someone else's docker image?
- Yes
- Have you searched for similar issues (both open and closed)?
- Yes
Describe the bug
When setting new password for user in UI console the password is being saved but it cannot be used. When entering to log in it always fails. Seems to be an issue with hashing of the password in the database. When I manually enter the password hash into the auth table of the database, the password works fine (using: update auth set secret='[hashed_secret]' where id='[id]';).
What I believe is important is that I am using ARM device as host for NPM running under Docker with Postgres 17 database. According to the documentation there were no requirements concerning version of Postgres database and this platform (ARM64) is supported. The CPU used for the deployment is Rockchip RK3566 with 8GB of RAM.
Nginx Proxy Manager Version
2.12.3
To Reproduce
Steps to reproduce the behavior:
- Run new instance of NPM.
- Login using default credentials (works fine).
- Create new user and password.
- Logout.
- Login does not work with new password.
Workaround
- Generate the same (or any other) password using bcrypt hash generator.
- Insert into auth table generated password as indicated above.
- Login with new password works fine.
Summary
Pre-generated hashes work fine, hashes generated and saved in the database by the application do not work and do not match with password when checked with hash validation tools.
Expected behavior
Able to login with changed password.
Screenshots
Not applicable.
Operating System
Linux DietPi 5.10.160-legacy-rk35xx #1 SMP Wed Jul 10 09:57:26 UTC 2024 aarch64 GNU/Linux
Additional context
Not needed.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the password-change and login sequence using the reported ARM64 Docker setup with PostgreSQL 17, then compare an application-generated value in the auth table with a manually inserted bcrypt hash. Trace the UI password update and subsequent login flow; done means newly changed passwords authenticate successfully and the stored hash validates correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, postgresql, typescript
- Domain
- authentication, backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100