alibaba/nacos · warning · IllegalArgumentException

Password length must not exceed {MAX_PASSWORD_LENGTH} charac

Error message

Password length must not exceed {MAX_PASSWORD_LENGTH} characters

What it means

Thrown by PasswordEncoderUtil.encode() when the raw password length exceeds AuthConstants.MAX_PASSWORD_LENGTH. This guard prevents excessively long passwords from reaching the BCrypt encoder, which has its own internal length limit (72 bytes) and can be a DoS vector if unbounded. The constant MAX_PASSWORD_LENGTH defines the application-level cap.

Source

Thrown at plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java:44

 */
public class PasswordEncoderUtil {
    
    public static Boolean matches(String raw, String encoded) {
        return new SafeBcryptPasswordEncoder().matches(raw, encoded);
    }
    
    /**
     * Encode password.
     *
     * @param raw password
     * @return encoded password
     */
    public static String encode(String raw) {
        if (raw == null) {
            throw new IllegalArgumentException("Password cannot be null");
        }
        if (raw.length() > AuthConstants.MAX_PASSWORD_LENGTH) {
            throw new IllegalArgumentException("Password length must not exceed "
                + AuthConstants.MAX_PASSWORD_LENGTH + " characters");
        }
        return new SafeBcryptPasswordEncoder().encode(raw);
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Check the value of AuthConstants.MAX_PASSWORD_LENGTH and enforce the same limit at the API/UI layer before calling encode().
2. Add client-side and server-side input validation to reject passwords exceeding the limit with a user-friendly message.
3. If the password came from a paste or import, verify it wasn't corrupted with extra data.

Example fix

// before
String encoded = PasswordEncoderUtil.encode(rawPassword);

// after: validate at the boundary
if (rawPassword.length() > AuthConstants.MAX_PASSWORD_LENGTH) {
    return Result.failure("Password too long, max " + AuthConstants.MAX_PASSWORD_LENGTH);
}
String encoded = PasswordEncoderUtil.encode(rawPassword);

// Enforce password length limit at the boundary
int maxLength = AuthConstants.MAX_PASSWORD_LENGTH;
if (raw != null && raw.length() > maxLength) {
    throw new IllegalArgumentException(
        "Password must not exceed " + maxLength + " characters");
}
String encoded = PasswordEncoderUtil.encode(raw);

public static boolean isPasswordWithinLimit(String raw) {
    return raw != null && raw.length() <= AuthConstants.MAX_PASSWORD_LENGTH;
}

try {
    String encoded = PasswordEncoderUtil.encode(rawPassword);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("must not exceed")) {
        return Result.failure(e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Calling PasswordEncoderUtil.encode(rawPassword) where rawPassword.length() > AuthConstants.MAX_PASSWORD_LENGTH. This typically happens when a client sends an extremely long password string.

Common situations: A client accidentally sends a token or encoded string as a password; a paste error puts a long string in the password field; automated testing with very long strings; a security scanner probing for buffer-overflow-style vulnerabilities.

Related errors

• password is blank
• Password cannot be null
• Request parameter `agentSpecCard` should not be null or empt
• Required parameter `agentSpecCard.name` is not present.
• Request parameter `name` should not be null or empty.

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/e4c4554feb7807ce. Report an issue: GitHub.