{"record":{"id":"50aba8590d0f8800","repo":"bytedance/deer-flow","slug":"password-is-too-common-choose-a-stronger-password","errorCode":null,"errorMessage":"Password is too common; choose a stronger password.","messagePattern":"Password is too common; choose a stronger password\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"warning","filePath":"backend/app/gateway/routers/auth.py","lineNumber":122,"sourceCode":"\n    Lowercases the input so trivial mutations like ``Password`` /\n    ``PASSWORD`` are also rejected. Does not normalize digit substitutions\n    (``p@ssw0rd`` is included as a literal entry instead) — keeping the\n    rule cheap and predictable.\n    \"\"\"\n    return password.lower() in _COMMON_PASSWORDS\n\n\ndef _validate_strong_password(value: str) -> str:\n    \"\"\"Pydantic field-validator body shared by Register + ChangePassword.\n\n    Constraint = function, not type-level mixin. The two request models\n    have no \"is-a\" relationship; they only share the password-strength\n    rule. Lifting it into a free function lets each model bind it via\n    ``@field_validator(field_name)`` without inheritance gymnastics.\n    \"\"\"\n    if _password_is_common(value):\n        raise ValueError(\"Password is too common; choose a stronger password.\")\n    return value\n\n\nclass RegisterRequest(BaseModel):\n    \"\"\"Request model for user registration.\"\"\"\n\n    email: EmailStr\n    password: str = Field(..., min_length=8)\n    remember_me: bool = True\n\n    _strong_password = field_validator(\"password\")(classmethod(lambda cls, v: _validate_strong_password(v)))\n\n\nclass ChangePasswordRequest(BaseModel):\n    \"\"\"Request model for password change (also handles setup flow).\"\"\"\n\n    current_password: str\n    new_password: str = Field(..., min_length=8)","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/routers/auth.py#L104-L140","documentation":"Raised as a ValueError inside a Pydantic field_validator shared by RegisterRequest and ChangePasswordRequest when the supplied password (case-insensitively) matches an entry in the built-in common-passwords list. FastAPI converts the validation failure to a 422 Unprocessable Entity with this message in the errors array — it never reaches the route body.","triggerScenarios":"POST /api/auth/register or POST /api/auth/change-password with a password like 'password', '12345678', or any entry of _COMMON_PASSWORDS regardless of case ('Password123' fails if 'password123' is listed).","commonSituations":"Seed/demo scripts using throwaway passwords; test suites with fixed weak credentials suddenly failing after the strength check was added; users reusing well-known passwords.","solutions":["Choose a password absent from common-password lists — a random generated one always passes","Update test fixtures and seed data to use strong generated passwords","Handle 422 on these endpoints by surfacing the message to the user instead of retrying","If a curated allowlist of test passwords is needed, ensure they are random-looking, not dictionary words"],"exampleFix":"# before\nRegisterRequest(email=\"a@b.c\", password=\"password\")\n\n# after\nimport secrets\nRegisterRequest(email=\"a@b.c\", password=secrets.token_urlsafe(16))","handlingStrategy":"validation","validationCode":"function isCommonPassword(pw) { return COMMON_LIST.has(pw.toLowerCase()); }\nif (isCommonPassword(password)) throw new Error('Pick a stronger password');","typeGuard":null,"tryCatchPattern":"try { await register(email, password); } catch (e) { if (e.status === 422 && /too common/.test(e.body)) { promptStrongerPassword(); return; } throw e; }","preventionTips":["Generate passwords with secrets/token_urlsafe in scripts and tests","Client-side, reject dictionary-word passwords before submission"],"tags":["auth","http-422","validation","password"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}