OTP signup fails with 422 when minimum_password_length is high

Open
#2,456 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
go
Domain
authentication

Research direction

Start by reproducing the failure with minimum_password_length = 100 in config.toml and the signInWithOtp OTP flow. Trace how OTP signup creates and validates its internally generated password, then verify that the flow succeeds without a weak_password 422 while ordinary password validation remains covered.

Written by the indexing model from the issue text.

Description

Bug report

Describe the bug

When minimum_password_length is set to a high value (e.g. 100) in config.toml, signInWithOtp fails with a 422 error:

{"code":422,"error_code":"weak_password","msg":"Password should be at least 100 characters.","weak_password":{"reasons":["length"]}}

OTP signup is passwordless — no password is supplied by the client. It appears that GoTrue internally generates a dummy password when creating the user account, but that generated password doesn't respect the minimum_password_length setting. It then validates the password it just generated against the config and rejects it.

To reproduce
  1. Set minimum_password_length = 100 in config.toml under [auth]
  2. Enable OTP/magic link signup (enable_signup = true under [auth.email])
  3. Call supabase.auth.signInWithOtp({ email: "test@example.com" })
  4. Get 422 Unprocessable Entity error
Expected behavior

OTP signup should work regardless of minimum_password_length, since no password is involved. The internally generated dummy password should either bypass the length check or be generated to match the configured minimum.

System information
  • Local Supabase CLI
  • OTP / magic link auth flow
Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.