{"record":{"id":"0930eb91fd610b73","repo":"AdguardTeam/AdGuardHome","slug":"generating-password-hash-w","errorCode":null,"errorMessage":"generating password hash: %w","messagePattern":"generating password hash: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configmigrate/v5.go","lineNumber":41,"sourceCode":"//\t# …\nfunc (m *Migrator) migrateTo5(_ context.Context, diskConf yobj) (err error) {\n\tdiskConf[\"schema_version\"] = 5\n\n\tuser := yobj{}\n\n\tif err = moveVal[string](diskConf, user, \"auth_name\", \"name\"); err != nil {\n\t\treturn err\n\t}\n\n\tpass, ok, err := fieldVal[string](diskConf, \"auth_pass\")\n\tif !ok {\n\t\treturn err\n\t}\n\tdelete(diskConf, \"auth_pass\")\n\n\thash, err := bcrypt.GenerateFromPassword([]byte(pass), bcrypt.DefaultCost)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"generating password hash: %w\", err)\n\t}\n\n\tuser[\"password\"] = string(hash)\n\tdiskConf[\"users\"] = yarr{user}\n\n\treturn nil\n}\n","sourceCodeStart":23,"sourceCodeEnd":49,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/configmigrate/v5.go#L23-L49","documentation":"During migration to schema 5, bcrypt failed to hash the legacy plaintext auth_pass so it could be moved into the users structure. The bcrypt error is wrapped; with a valid password string this is essentially unreachable, since bcrypt only fails on inputs longer than 72 bytes or cost out of range.","triggerScenarios":"Migrating a very old config whose auth_pass exceeds 72 bytes (bcrypt's input limit) or a bcrypt cost issue with DefaultCost on constrained platforms.","commonSituations":"Ancient configs with extremely long passwords; FIPS-restricted or limited environments where bcrypt primitives are unavailable.","solutions":["Shorten the legacy auth_pass to ≤ 72 characters and re-run the migration","If the password is already hashed or unused, remove auth_pass before migrating","Upgrade to a newer config schema or regenerate the config and set the password via the UI"],"exampleFix":"# before\nauth_pass: \"an extremely long legacy password exceeding seventy two bytes ...\"\n\n# after\nauth_pass: \"shorter-legacy-password\"","handlingStrategy":"validation","validationCode":"if len(pass) > 72 { /* truncate or shorten the legacy auth_pass before migrating */ }","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"generating password hash\") { /* shorten auth_pass to ≤72 bytes and re-run Migrate */ }","preventionTips":["Keep legacy passwords under bcrypt's 72-byte limit","Remove auth_pass if the password is already managed via users"],"tags":["config","migration","auth","bcrypt","password"],"backgroundTag":"password-hashing-failed","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}