{"record":{"id":"e4c4554feb7807ce","repo":"alibaba/nacos","slug":"password-length-must-not-exceed-max-password-leng","errorCode":null,"errorMessage":"Password length must not exceed {MAX_PASSWORD_LENGTH} characters","messagePattern":"Password length must not exceed (.+?) characters","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"warning","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java","lineNumber":44,"sourceCode":" */\npublic class PasswordEncoderUtil {\n    \n    public static Boolean matches(String raw, String encoded) {\n        return new SafeBcryptPasswordEncoder().matches(raw, encoded);\n    }\n    \n    /**\n     * Encode password.\n     *\n     * @param raw password\n     * @return encoded password\n     */\n    public static String encode(String raw) {\n        if (raw == null) {\n            throw new IllegalArgumentException(\"Password cannot be null\");\n        }\n        if (raw.length() > AuthConstants.MAX_PASSWORD_LENGTH) {\n            throw new IllegalArgumentException(\"Password length must not exceed \"\n                + AuthConstants.MAX_PASSWORD_LENGTH + \" characters\");\n        }\n        return new SafeBcryptPasswordEncoder().encode(raw);\n    }\n}\n","sourceCodeStart":26,"sourceCodeEnd":50,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/PasswordEncoderUtil.java#L26-L50","documentation":"Thrown by PasswordEncoderUtil.encode() when the raw password length exceeds AuthConstants.MAX_PASSWORD_LENGTH. This guard prevents excessively long passwords from reaching the BCrypt encoder, which has its own internal length limit (72 bytes) and can be a DoS vector if unbounded. The constant MAX_PASSWORD_LENGTH defines the application-level cap.","triggerScenarios":"Calling PasswordEncoderUtil.encode(rawPassword) where rawPassword.length() > AuthConstants.MAX_PASSWORD_LENGTH. This typically happens when a client sends an extremely long password string.","commonSituations":"A client accidentally sends a token or encoded string as a password; a paste error puts a long string in the password field; automated testing with very long strings; a security scanner probing for buffer-overflow-style vulnerabilities.","solutions":["Check the value of AuthConstants.MAX_PASSWORD_LENGTH and enforce the same limit at the API/UI layer before calling encode().","Add client-side and server-side input validation to reject passwords exceeding the limit with a user-friendly message.","If the password came from a paste or import, verify it wasn't corrupted with extra data."],"exampleFix":"// before\nString encoded = PasswordEncoderUtil.encode(rawPassword);\n\n// after: validate at the boundary\nif (rawPassword.length() > AuthConstants.MAX_PASSWORD_LENGTH) {\n    return Result.failure(\"Password too long, max \" + AuthConstants.MAX_PASSWORD_LENGTH);\n}\nString encoded = PasswordEncoderUtil.encode(rawPassword);","handlingStrategy":"validation","validationCode":"// Enforce password length limit at the boundary\nint maxLength = AuthConstants.MAX_PASSWORD_LENGTH;\nif (raw != null && raw.length() > maxLength) {\n    throw new IllegalArgumentException(\n        \"Password must not exceed \" + maxLength + \" characters\");\n}\nString encoded = PasswordEncoderUtil.encode(raw);","typeGuard":"public static boolean isPasswordWithinLimit(String raw) {\n    return raw != null && raw.length() <= AuthConstants.MAX_PASSWORD_LENGTH;\n}","tryCatchPattern":"try {\n    String encoded = PasswordEncoderUtil.encode(rawPassword);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"must not exceed\")) {\n        return Result.failure(e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Enforce MAX_PASSWORD_LENGTH at the API and UI layer with client-side validation.","Use @Size(max = ...) Bean Validation annotations on password fields.","Log password length (not the password itself) when validation fails to diagnose anomalies."],"tags":["auth","password","validation","input-limits"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}