{"record":{"id":"c3d85e95b66607e9","repo":"coder/code-server","slug":"password-can-only-be-set-in-the-config-file-or-p","errorCode":null,"errorMessage":"--password can only be set in the config file or passed in via $PASSWORD","messagePattern":"--password can only be set in the config file or passed in via \\$PASSWORD","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/node/cli.ts","lineNumber":407,"sourceCode":"      let value: string | undefined\n      if (arg.startsWith(\"--\")) {\n        const split = splitOnFirstEquals(arg.replace(/^--/, \"\"))\n        key = split[0] as keyof UserProvidedArgs\n        value = split[1]\n      } else {\n        const short = arg.replace(/^-/, \"\")\n        const pair = Object.entries(options).find(([, v]) => v.short === short)\n        if (pair) {\n          key = pair[0] as keyof UserProvidedArgs\n        }\n      }\n\n      if (!key || !options[key]) {\n        throw error(`Unknown option ${arg}`)\n      }\n\n      if (key === \"password\" && !opts?.configFile) {\n        throw new Error(\"--password can only be set in the config file or passed in via $PASSWORD\")\n      }\n\n      if (key === \"hashed-password\" && !opts?.configFile) {\n        throw new Error(\"--hashed-password can only be set in the config file or passed in via $HASHED_PASSWORD\")\n      }\n\n      if (key === \"github-auth\" && !opts?.configFile) {\n        throw new Error(\"--github-auth can only be set in the config file or passed in via $GITHUB_TOKEN\")\n      }\n\n      if (key === \"idle-timeout-seconds\" && Number(value) <= 60) {\n        throw new Error(\"--idle-timeout-seconds must be greater than 60 seconds.\")\n      }\n\n      const option = options[key]\n      if (option.type === \"boolean\") {\n        ;(args[key] as boolean) = true\n        continue","sourceCodeStart":389,"sourceCodeEnd":425,"githubUrl":"https://github.com/coder/code-server/blob/51f90a376b42e217b38937410fe2855e0c1db87e/src/node/cli.ts#L389-L425","documentation":"code-server refuses the `--password` CLI flag because process arguments are visible to other users via `ps`/`/proc` and leak into shell history. The guard at cli.ts:407 only permits the password when opts.configFile is set (i.e. the value came from the config file), so a bare command-line password is rejected. Use the config file or the $PASSWORD environment variable instead.","triggerScenarios":"Invoking `code-server --password=secret`, `code-server --password secret`, or any form that places the password key in argv while parsing the command line (not the config file).","commonSituations":"Quick local testing where a developer passes the password inline; copy-pasting from outdated tutorials that predate the security restriction; Docker entrypoints that pass `--password` in the CMD.","solutions":["Move the password into the config file (~/.config/code-server/config.yaml) under `password:`","Export it as an environment variable: `export PASSWORD=secret` then run `code-server`","For Docker/k8s, set the PASSWORD env var on the container instead of a CLI arg"],"exampleFix":"# before\ncode-server --password=secret\n\n# after\nexport PASSWORD=secret\ncode-server\n# or in ~/.config/code-server/config.yaml:\n# password: secret","handlingStrategy":"validation","validationCode":"// Before spawning code-server, ensure no secret CLI flags are present\nconst SECRET_FLAGS = [\"--password\", \"--hashed-password\", \"--github-auth\"]\nconst leaked = process.argv.filter((a) =>\n  SECRET_FLAGS.some((f) => a === f || a.startsWith(f + \"=\"))\n)\nif (leaked.length) {\n  throw new Error(\n    `Refusing to run: ${leaked.join(\", \")} on the CLI. Use $PASSWORD / config file.`\n  )\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat all code-server secrets as env vars or config-file entries, never argv","Audit Docker CMD/k8s command lines for `--password*` flags","Use a secrets manager that writes to $PASSWORD at container start"],"tags":["security","cli","credentials","secrets","configuration"],"backgroundTag":null,"analyzedSha":"51f90a376b42e217b38937410fe2855e0c1db87e","analyzedAt":"2026-08-12T11:27:34.273Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}