gotify / gotify/server

Remove default admin password

Open
#1,008 2 comments 2 reactions 0 assignees View on GitHub
a:feature
Dominant language
Go
Stars
15.9k
Forks
873
Avg merge
2d 22h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
Forcing the administrator to configure a secure password on first run, may increase security in case the administrator doesn't follow the [first login instructions](https://gotify.net/docs/first-login).

**Describe the solution you'd like**
On first run, the user must configure GOTIFY_DEFAULTUSER_PASS. Without it being configured gotify/server shouldn't start because no default user could be created.
~~Maybe we should provide a flag, to disable creating the default user in case all users are managed by OIDC.~~ See #1007

Contributor guide

Open the contributing guide

Research direction

Begin at gotify/server startup and trace first-run default-user creation and the GOTIFY_DEFAULTUSER_PASS configuration. Check issue #1007 for the OIDC context, then verify startup behavior when the variable is absent and present. Done means the server requires the configured password before creating the default user.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, backend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.