glanceapp/glance · error

user %s must have a password or a password-hash set

Error message

user %s must have a password or a password-hash set

What it means

A configured user has neither password nor password-hash set. Glance requires exactly one form of credential: a plaintext password (which it will hash) or a pre-computed password-hash (e.g. for deployments where secrets must not appear in plaintext).

Source

Thrown at internal/glance/config.go:473

	if len(config.Auth.Users) > 0 && config.Auth.SecretKey == "" {
		return fmt.Errorf("secret-key must be set when users are configured")
	}

	for username := range config.Auth.Users {
		if username == "" {
			return fmt.Errorf("user has no name")
		}

		if len(username) < 3 {
			return errors.New("usernames must be at least 3 characters")
		}

		user := config.Auth.Users[username]

		if user.Password == "" {
			if user.PasswordHashString == "" {
				return fmt.Errorf("user %s must have a password or a password-hash set", username)
			}
		} else if len(user.Password) < 6 {
			return fmt.Errorf("the password for %s must be at least 6 characters", username)
		}
	}

	if config.Server.AssetsPath != "" {
		if _, err := os.Stat(config.Server.AssetsPath); os.IsNotExist(err) {
			return fmt.Errorf("assets directory does not exist: %s", config.Server.AssetsPath)
		}
	}

	for i := range config.Pages {
		page := &config.Pages[i]

		if page.Title == "" {
			return fmt.Errorf("page %d has no name", i+1)
		}

View on GitHub (pinned to 91324e8de7)

Solutions

1. Add a password or a password-hash field to the user named in the message
2. If using variable expansion for the password, confirm the environment variable is non-empty
3. Check field spelling — password and password-hash are the accepted keys

Example fix

# before
- username: alice
# after
- username: alice
  password: ${GLANCE_ALICE_PASSWORD}
# or pre-hashed:
- username: alice
  password-hash: $2y$10$...

for name, u := range cfg.Auth.Users {
    if u.Password == "" && u.PasswordHashString == "" {
        return fmt.Errorf("user %s lacks credentials", name)
    }
}

When it happens

Trigger: A user entry with a username but both password and password-hash omitted, or misnamed so both decode to empty strings. Note empty-string values count as unset.

Common situations: Intending to set the password via an env variable that is empty; typos like pass-word; forgetting the credential when adding a user; password-hash key misspelled.

Related errors

• secret-key must be set when users are configured
• user has no name
• the password for %s must be at least 6 characters
• %s widget: %v
• recursion depth limit of %d reached

AI-assisted analysis of glanceapp/glance@91324e8de7 (2026-08-15). Data as JSON: /api/errors/e7b1457a21927ec3. Report an issue: GitHub.