bytedance/deer-flow · warning · ValueError

Password is too common; choose a stronger password.

Error message

Password is too common; choose a stronger password.

What it means

Raised as a ValueError inside a Pydantic field_validator shared by RegisterRequest and ChangePasswordRequest when the supplied password (case-insensitively) matches an entry in the built-in common-passwords list. FastAPI converts the validation failure to a 422 Unprocessable Entity with this message in the errors array — it never reaches the route body.

Source

Thrown at backend/app/gateway/routers/auth.py:122

    Lowercases the input so trivial mutations like ``Password`` /
    ``PASSWORD`` are also rejected. Does not normalize digit substitutions
    (``p@ssw0rd`` is included as a literal entry instead) — keeping the
    rule cheap and predictable.
    """
    return password.lower() in _COMMON_PASSWORDS


def _validate_strong_password(value: str) -> str:
    """Pydantic field-validator body shared by Register + ChangePassword.

    Constraint = function, not type-level mixin. The two request models
    have no "is-a" relationship; they only share the password-strength
    rule. Lifting it into a free function lets each model bind it via
    ``@field_validator(field_name)`` without inheritance gymnastics.
    """
    if _password_is_common(value):
        raise ValueError("Password is too common; choose a stronger password.")
    return value


class RegisterRequest(BaseModel):
    """Request model for user registration."""

    email: EmailStr
    password: str = Field(..., min_length=8)
    remember_me: bool = True

    _strong_password = field_validator("password")(classmethod(lambda cls, v: _validate_strong_password(v)))


class ChangePasswordRequest(BaseModel):
    """Request model for password change (also handles setup flow)."""

    current_password: str
    new_password: str = Field(..., min_length=8)

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Choose a password absent from common-password lists — a random generated one always passes
2. Update test fixtures and seed data to use strong generated passwords
3. Handle 422 on these endpoints by surfacing the message to the user instead of retrying
4. If a curated allowlist of test passwords is needed, ensure they are random-looking, not dictionary words

Example fix

# before
RegisterRequest(email="a@b.c", password="password")

# after
import secrets
RegisterRequest(email="a@b.c", password=secrets.token_urlsafe(16))

function isCommonPassword(pw) { return COMMON_LIST.has(pw.toLowerCase()); }
if (isCommonPassword(password)) throw new Error('Pick a stronger password');

try { await register(email, password); } catch (e) { if (e.status === 422 && /too common/.test(e.body)) { promptStrongerPassword(); return; } throw e; }

When it happens

Trigger: POST /api/auth/register or POST /api/auth/change-password with a password like 'password', '12345678', or any entry of _COMMON_PASSWORDS regardless of case ('Password123' fails if 'password123' is listed).

Common situations: Seed/demo scripts using throwaway passwords; test suites with fixed weak credentials suddenly failing after the strength check was added; users reusing well-known passwords.

Related errors

• Unable to recover SSE history after ${recoveryAttempts} atte
• Invalid agent name '{name}'. Must match ^[A-Za-z0-9-]+$ (let
• Unknown model '{model}'. Use a model name defined under `mod
• Invalid provider ID
• Unsupported context_mode

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/50aba8590d0f8800. Report an issue: GitHub.