{"record":{"id":"ed0cea3e464dee31","repo":"t8y2/dbx","slug":"failed-to-hash-password","errorCode":null,"errorMessage":"Failed to hash password","messagePattern":"Failed to hash password","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/dbx-web/src/main.rs","lineNumber":345,"sourceCode":"\n        Arc::new(AppState::new_with_plugin_and_agent_dir_and_app_version(\n            storage,\n            data_dir.join(\"plugins\"),\n            web_agent_dir(&data_dir),\n            env!(\"CARGO_PKG_VERSION\"),\n        ))\n    };\n\n    // Password hash: env var takes priority, then database\n    let password_disabled = std::env::var(\"DBX_DISABLE_PASSWORD\")\n        .map(|v| matches!(v.trim().to_lowercase().as_str(), \"1\" | \"true\" | \"yes\" | \"on\"))\n        .unwrap_or(false);\n\n    let password_hash = if password_disabled {\n        None\n    } else if let Ok(pw) = std::env::var(\"DBX_PASSWORD\") {\n        let salt = SaltString::generate(&mut OsRng);\n        Some(Argon2::default().hash_password(pw.as_bytes(), &salt).expect(\"Failed to hash password\").to_string())\n    } else {\n        app_state.storage.load_password_hash().await.unwrap_or(None)\n    };\n\n    let public_base_path = normalize_public_base_path(std::env::var(\"DBX_PUBLIC_BASE_PATH\").ok());\n\n    let web_state = Arc::new(WebState {\n        app: app_state,\n        data_dir,\n        public_base_path: public_base_path.clone(),\n        password_disabled,\n        password_hash: RwLock::new(password_hash),\n        sessions: RwLock::new(HashSet::new()),\n        sse_channels: RwLock::new(HashMap::new()),\n        transfer_progress_channels: RwLock::new(HashMap::new()),\n        table_import_channels: RwLock::new(HashMap::new()),\n        sql_file_executions: RwLock::new(HashMap::new()),\n        nacos_imports: RwLock::new(HashMap::new()),","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/crates/dbx-web/src/main.rs#L327-L363","documentation":"Panics/aborts in dbx-web main when hashing the configured password (from DBX_PASSWORD or the database) fails — the password hashing routine (e.g. argon2/bcrypt setup) returned an error. This is an environment/parameter-level failure of the login credential setup, not a wrong password.","triggerScenarios":"Argon2::default().hash_password(pw.as_bytes(), &salt) returns Err — practically only when the password exceeds Argon2's size limits or the allocator fails for the chosen memory cost parameters.","commonSituations":"Setting DBX_PASSWORD to an extremely large value (e.g., piping a huge file or base64 blob into the env var); running on a memory-constrained system where the Argon2 memory allocation fails.","solutions":["Use a reasonably sized DBX_PASSWORD (normal passphrase length); avoid multi-megabyte values.","Verify the env var actually contains the intended short password (echo ${#DBX_PASSWORD} to check length).","Handle the error gracefully: log and fall back to loading the stored hash or disabling auth instead of panicking."],"exampleFix":"// before\nSome(Argon2::default().hash_password(pw.as_bytes(), &salt).expect(\"Failed to hash password\").to_string())\n// after\nmatch Argon2::default().hash_password(pw.as_bytes(), &salt) {\n    Ok(hash) => Some(hash.to_string()),\n    Err(e) => { eprintln!(\"Failed to hash password: {e}\"); None }\n}","handlingStrategy":"validation","validationCode":"fn password_len_ok() -> bool {\n    std::env::var(\"DBX_PASSWORD\")\n        .map(|pw| !pw.is_empty() && pw.len() <= 1024)\n        .unwrap_or(true)\n}","typeGuard":null,"tryCatchPattern":"match std::env::var(\"DBX_PASSWORD\") {\n    Ok(pw) if !pw.is_empty() && pw.len() <= 1024 => match Argon2::default().hash_password(pw.as_bytes(), &salt) {\n        Ok(h) => Some(h.to_string()),\n        Err(e) => { eprintln!(\"Failed to hash password: {e}\"); None }\n    },\n    _ => app_state.storage.load_password_hash().await.unwrap_or(None),\n}","preventionTips":["Keep DBX_PASSWORD a normal-length secret (passphrase, not a file blob).","Do not pipe large files or base64 payloads into the env var.","Provide enough memory for Argon2's default cost parameters."],"tags":["argon2","rust","password","startup"],"backgroundTag":"password-hashing-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}