gotify / gotify/server

Allow password length over 71 chars

Open
#798 6 comments 0 reactions 0 assignees View on GitHub
a:feature in:server
Dominant language
Go
Stars
15.9k
Forks
873
Avg merge
2d 22h
Merged PRs (30d)
6

Description

**Is your feature request related to a problem? Please describe.**
When setting environment variable `GOTIFY_DEFAULTUSER_PASS` or the password in `GOTIFY_DATABASE_CONNECTION` to a string longer than 71 chars, I get the following error in my journalctl:
```
systemd[1]: Started podman-gotify.service.
<...>[8313]: <...>
<...>[8329]: Starting Gotify version 2.6.3@2025-04-27-09:10:38
<...>[8329]: panic: bcrypt: password length exceeds 72 bytes
<...>[8329]:
<...>[8329]: goroutine 1 [running]:
<...>[8329]: github.com/gotify/server/v2/auth/password.CreatePassword(...)
<...>[8329]: /src/gotify/auth/password/password.go:9
<...>[8329]: github.com/gotify/server/v2/database.New(<...>)
<...>[8329]: /src/gotify/database/database.go:58 +0x469
<...>[8329]: main.main()
<...>[8329]: /src/gotify/app.go:42 +0x236
<...>[8339]: 2025-05-18 13:23:14.006036461 +0000 UTC m=+0.048855570 container died <...> (image=docker.io/gotify/server:2, name=<...>, PODMAN_SYSTEMD_UNIT=p>
<...>[8339]: 2025-05-18 13:23:14.218830403 +0000 UTC m=+0.261649572 container remove <...> (image=docker.io/gotify/server:2, name=<...>, pod_id=<...>>
systemd[1]: podman-gotify.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
systemd[1]: podman-gotify.service: Failed with result 'exit-code'.
systemd[1]: podman-gotify.service: Consumed 610ms CPU time, 19.5M memory peak, 13.3M written to disk.
systemd[1]: podman-gotify.service: Scheduled restart job, restart counter is at 5.
```

[This](https://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length) is a thread that describes the problem in detail.

**Describe the solution you'd like**
I'm not familiar with go and haven't used any of these libraries, but after some research it was often suggested to use [argon2id package](https://pkg.go.dev/github.com/alexedwards/argon2id).

**Describe alternatives you've considered**
- Implement an environemnt variable/config option to let the user choose the algorithm.
- Add note to config that passwords are limited to 71 UTF-8 chars

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.