Remove default admin password
- Dominant language
- Go
- Stars
- 15.9k
- Forks
- 873
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 6
Description
**Is your feature request related to a problem? Please describe.**
Forcing the administrator to configure a secure password on first run, may increase security in case the administrator doesn't follow the [first login instructions](https://gotify.net/docs/first-login).
**Describe the solution you'd like**
On first run, the user must configure GOTIFY_DEFAULTUSER_PASS. Without it being configured gotify/server shouldn't start because no default user could be created.
~~Maybe we should provide a flag, to disable creating the default user in case all users are managed by OIDC.~~ See #1007
Contributor guide
Research direction
Begin at gotify/server startup and trace first-run default-user creation and the GOTIFY_DEFAULTUSER_PASS configuration. Check issue #1007 for the OIDC context, then verify startup behavior when the variable is absent and present. Done means the server requires the configured password before creating the default user.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100