What causes "password must be at most %d bytes" in JuliusBrussee/caveman?

Cap password input length client-side (e.g. maxlength) and server-side before calling ValidatePassword.

password must be at most %d bytes

Error message

password must be at most %d bytes

What it means

security.ValidatePassword rejects inputs longer than MaxPasswordBytes = 1024 bytes. The cap exists to prevent resource-exhaustion via argon2 on huge inputs and to bound request handling; it is a length check only, not a complexity check.

Source

Thrown at shared/platform/security/keys.go:25

	"encoding/base64"
	"encoding/hex"
	"fmt"
	"strings"

	"golang.org/x/crypto/argon2"
)

const (
	MinPasswordBytes = 12
	MaxPasswordBytes = 1024
)

func ValidatePassword(password string) error {
	if len(password) < MinPasswordBytes {
		return fmt.Errorf("password must be at least %d bytes", MinPasswordBytes)
	}
	if len(password) > MaxPasswordBytes {
		return fmt.Errorf("password must be at most %d bytes", MaxPasswordBytes)
	}
	return nil
}

func GenerateProjectKey() (string, string, error) {
	raw := make([]byte, 32)
	if _, err := rand.Read(raw); err != nil {
		return "", "", err
	}
	secret := base64.RawURLEncoding.EncodeToString(raw)
	full := "cave_live_" + secret[:12] + "_" + secret[12:]
	return full, secret[:12], nil
}

func HashProjectKey(pepper, full string) string {
	mac := hmac.New(sha256.New, []byte(pepper))
	mac.Write([]byte(full))
	return hex.EncodeToString(mac.Sum(nil))

View on GitHub (pinned to 27d5a3981a)

Solutions

Cap password input length client-side (e.g. maxlength) and server-side before calling ValidatePassword.
Fix the caller that passes the wrong field/blob into the password parameter.
If legitimate use requires more, revisit the API — passwords should never approach 1 KiB; prefer a key file for that.

Example fix

// before
err := security.ValidatePassword(request.Body) // body can be MBs

// after
if len(request.Body) > security.MaxPasswordBytes {
    return fmt.Errorf("input too large")
}
err := security.ValidatePassword(string(request.Body))

Defensive patterns

Strategy: validation

Validate before calling

if len(password) > security.MaxPasswordBytes {
    return fmt.Errorf("password too long (max %d bytes)", security.MaxPasswordBytes)
}

Type guard

func withinMaxPasswordBytes(pw string) bool { return len(pw) <= security.MaxPasswordBytes }

Try / catch

if err := security.ValidatePassword(pw); err != nil {
    // treat as client error; check which bound tripped via message
}

Prevention

Cap password inputs at the form/API layer (maxlength or request validation).
A password near 1 KiB almost always means the wrong field is being passed — assert field names in tests.

When it happens

Trigger: Calling security.ValidatePassword with a string over 1024 bytes, e.g. a pasted passphrase manager blob, a keyboard mash, or a client that accidentally sends the whole form as the password field.

Common situations: Bug where the wrong form field or file content is passed as the password; automated fuzzers; clients concatenating tokens onto the password.

Related errors

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/eeef53faab0eb50e. Report an issue: GitHub.