No minimum password length — 2-character password accepted #24

New issue

Closed

opened 2026-05-14 14:30:16 +00:00 by Mark · 1 comment

Mark commented

2026-05-14 14:30:16 +00:00

Owner

Bug

The auth registration accepts a 2-character password ("ab") without any validation.

Evidence

curl -X POST http://localhost:3001/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"bad@test.com","name":"bad","password":"ab"}'

Response: HTTP 201, token and user created successfully

Impact

Combined with existing issue #13 (no rate limiting on auth endpoints), this creates a significant security risk — attackers can brute-force register accounts with trivial passwords and then attempt to compromise other users' accounts.

Severity

ORANGE High — No password policy enforcement. Related to existing #13 (no rate limiting).

Fix

Add minimum password length validation (e.g., 8 characters) in the register handler. Return 400 with a clear message.

## Bug The auth registration accepts a 2-character password ("ab") without any validation. ## Evidence ``` curl -X POST http://localhost:3001/api/auth/register \ -H "Content-Type: application/json" \ -d '{"email":"bad@test.com","name":"bad","password":"ab"}' Response: HTTP 201, token and user created successfully ``` ## Impact Combined with existing issue #13 (no rate limiting on auth endpoints), this creates a significant security risk — attackers can brute-force register accounts with trivial passwords and then attempt to compromise other users' accounts. ## Severity ORANGE **High** — No password policy enforcement. Related to existing #13 (no rate limiting). ## Fix Add minimum password length validation (e.g., 8 characters) in the register handler. Return 400 with a clear message.