{"record":{"id":"6a10584ac3c003ed","repo":"louislam/dockge","slug":"password-is-too-weak-it-should-contain-alphabetic","errorCode":null,"errorMessage":"Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.","messagePattern":"Password is too weak\\. It should contain alphabetic and numeric characters\\. It must be at least 6 characters in length\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"backend/socket-handlers/main-socket-handler.ts","lineNumber":35,"sourceCode":"} from \"../util-server\";\nimport { passwordStrength } from \"check-password-strength\";\nimport jwt from \"jsonwebtoken\";\nimport { Settings } from \"../settings\";\nimport fs, { promises as fsAsync } from \"fs\";\nimport path from \"path\";\n\nexport class MainSocketHandler extends SocketHandler {\n    create(socket : DockgeSocket, server : DockgeServer) {\n\n        // ***************************\n        // Public Socket API\n        // ***************************\n\n        // Setup\n        socket.on(\"setup\", async (username, password, callback) => {\n            try {\n                if (passwordStrength(password).value === \"Too weak\") {\n                    throw new Error(\"Password is too weak. It should contain alphabetic and numeric characters. It must be at least 6 characters in length.\");\n                }\n\n                if ((await R.knex(\"user\").count(\"id as count\").first()).count !== 0) {\n                    throw new Error(\"Dockge has been initialized. If you want to run setup again, please delete the database.\");\n                }\n\n                const user = R.dispense(\"user\");\n                user.username = username;\n                user.password = generatePasswordHash(password);\n                await R.store(user);\n\n                server.needSetup = false;\n\n                callback({\n                    ok: true,\n                    msg: \"successAdded\",\n                    msgi18n: true,\n                });","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/louislam/dockge/blob/f809ae192b571944ad773e9866d3e67064ae8043/backend/socket-handlers/main-socket-handler.ts#L17-L53","documentation":"During the 'setup' socket event, Dockge validates the admin password with the check-password-strength library. If the password scores 'Too weak' (default policy: too short or lacking alphabetic/numeric mix), the handler throws this Error before creating the initial user account. It is delivered to the client via the callback as {ok:false, msg}.","triggerScenarios":"Calling the 'setup' socket event with a password that check-password-strength rates 'Too weak' — e.g. fewer than 6 characters, or only letters / only digits with no mix.","commonSituations":"First-run initialization of a Dockge instance where the admin enters a short or single-character-class password; automated setup scripts posting weak default credentials; UIs not enforcing client-side strength checks before emitting 'setup'.","solutions":["Choose a password of at least 6 characters containing both alphabetic and numeric characters.","Check passwordStrength(password).value client-side before emitting the 'setup' event.","Retry the setup call with a stronger password; the error is returned via callback and the user is not created."],"exampleFix":"// before\nsocket.emit('setup', 'admin', '12345', callback);\n// after\nconst pwd = 'dockge123';\nif (passwordStrength(pwd).value !== 'Too weak') {\n    socket.emit('setup', 'admin', pwd, callback);\n}","handlingStrategy":"validation","validationCode":"import { passwordStrength } from 'check-password-strength';\nfunction isAcceptablePassword(pwd) {\n    return typeof pwd === 'string' && passwordStrength(pwd).value !== 'Too weak';\n}","typeGuard":"function isNonEmptyString(v) { return typeof v === 'string' && v.length >= 6; }","tryCatchPattern":"socket.emit('setup', username, password, (res) => {\n    if (!res.ok && res.msg.includes('too weak')) {\n        promptForStrongerPassword();\n    }\n});","preventionTips":["Enforce the same check-password-strength rule client-side before emitting","Require 6+ characters with both letters and digits in UI forms","Never submit default/placeholder passwords from automation scripts"],"tags":["validation","password","authentication","setup"],"backgroundTag":"weak-password-rejected","analyzedSha":"f809ae192b571944ad773e9866d3e67064ae8043","analyzedAt":"2026-08-31T19:13:50.919Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}