{"record":{"id":"1e7119867e55ebfa","repo":"glanceapp/glance","slug":"the-password-for-s-must-be-at-least-6-characters","errorCode":null,"errorMessage":"the password for %s must be at least 6 characters","messagePattern":"the password for (.+?) must be at least 6 characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/glance/config.go","lineNumber":476,"sourceCode":"\t}\n\n\tfor username := range config.Auth.Users {\n\t\tif username == \"\" {\n\t\t\treturn fmt.Errorf(\"user has no name\")\n\t\t}\n\n\t\tif len(username) < 3 {\n\t\t\treturn errors.New(\"usernames must be at least 3 characters\")\n\t\t}\n\n\t\tuser := config.Auth.Users[username]\n\n\t\tif user.Password == \"\" {\n\t\t\tif user.PasswordHashString == \"\" {\n\t\t\t\treturn fmt.Errorf(\"user %s must have a password or a password-hash set\", username)\n\t\t\t}\n\t\t} else if len(user.Password) < 6 {\n\t\t\treturn fmt.Errorf(\"the password for %s must be at least 6 characters\", username)\n\t\t}\n\t}\n\n\tif config.Server.AssetsPath != \"\" {\n\t\tif _, err := os.Stat(config.Server.AssetsPath); os.IsNotExist(err) {\n\t\t\treturn fmt.Errorf(\"assets directory does not exist: %s\", config.Server.AssetsPath)\n\t\t}\n\t}\n\n\tfor i := range config.Pages {\n\t\tpage := &config.Pages[i]\n\n\t\tif page.Title == \"\" {\n\t\t\treturn fmt.Errorf(\"page %d has no name\", i+1)\n\t\t}\n\n\t\tif page.Width != \"\" && (page.Width != \"wide\" && page.Width != \"slim\" && page.Width != \"default\") {\n\t\t\treturn fmt.Errorf(\"page %d: width can only be either wide or slim\", i+1)","sourceCodeStart":458,"sourceCodeEnd":494,"githubUrl":"https://github.com/glanceapp/glance/blob/91324e8de762702e97b0ac5c8e36271d644d8642/internal/glance/config.go#L458-L494","documentation":"A user's plaintext password is shorter than 6 characters. Glance enforces a minimum length on passwords supplied directly; password-hash entries bypass this because the original length is unknown.","triggerScenarios":"Setting auth.users[].password to any string of length 1-5 during config validation. Empty passwords take the other branch (must have password or password-hash).","commonSituations":"Quick test credentials like 'a' or '1234' in a dev config; a truncated environment variable when using ${VAR} expansion; pasting a password and losing characters.","solutions":["Use a password of at least 6 characters for the user named in the message","If the password comes from an env variable, verify the variable's full value is exported","For short throwaway creds in testing, use a password-hash of the short secret instead — or better, use a long one"],"exampleFix":"# before\n- username: alice\n  password: abc\n# after\n- username: alice\n  password: a-much-longer-secret","handlingStrategy":"validation","validationCode":"const minLen = 6\nfor name, u := range cfg.Auth.Users {\n    if u.Password != \"\" && len(u.Password) < minLen {\n        return fmt.Errorf(\"password for %s too short\", name)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use generated passwords of 12+ characters everywhere","For legacy short secrets, supply a bcrypt password-hash instead"],"tags":["glance","auth","validation","configuration"],"backgroundTag":null,"analyzedSha":"91324e8de762702e97b0ac5c8e36271d644d8642","analyzedAt":"2026-08-15T14:12:54.279Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}