Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sending a magic link will sometimes fail due to password.Generate generating an invalid password #1761

Closed
2 tasks done
klajdi369 opened this issue Sep 3, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@klajdi369
Copy link
Contributor

klajdi369 commented Sep 3, 2024

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

Sending a magic link will sometimes fail due to password.Generate generating an invalid password that complies with checkPasswordStrength

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

Using Selfhosted Docker

  1. GOTRUE_PASSWORD_REQUIRED_CHARACTERS: "!@#$%^&*()-_=+<>" to this value in environment under auth (or .env depending on how you are defining it)
  2. Sign up a new user
  3. Send magic link until it fails

Expected behavior

The action should sucessfully send an email with a magic link to the user.

Screenshots

image

System information

  • OS: [Ubuntu 22.04]
  • Browser (if applies) [N/A]
  • Version of supabase-js: [N/A]
  • Version of Node.js: [v20.11.1]

Additional context

Basically this line in /internal/api/magic_link.go
password.Generate(64, 10, 1, false, true)
Generates an invalid value for this line in /internal/api/signup.go
if err := a.checkPasswordStrength(ctx, p.Password); err != nil {

@klajdi369 klajdi369 added the bug Something isn't working label Sep 3, 2024
cstockton added a commit that referenced this issue Sep 24, 2024
## What kind of change does this PR introduce?

Bug fix

## What is the current behavior?

#1761

## What is the new behavior?

Now the password should generate secure enough with the necessary
password requirements specified in environment variables.

## Additional context

Basically this line in /internal/api/magic_link.go
password.Generate(64, 10, 1, false, true)
Generates an invalid value for this line in /internal/api/signup.go
if err := a.checkPasswordStrength(ctx, p.Password); err != nil {

---------

Co-authored-by: Chris Stockton <180184+cstockton@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant