mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-12-10 01:10:09 +03:00
Add an env var for minimal length of vaultwarden vault passwords #365
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @guerby on GitHub.
Vaultwarden Support String
N/A
Vaultwarden Build Version
1.32.0
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
N/A
Host/Server Operating System
Linux
Operating System Version
No response
Clients
Web Vault, Browser Extension, CLI, Desktop, Android, iOS
Client Version
No response
Steps To Reproduce
When creating a vault there is no way to force a minimun length for passwords
Expected Result
An environment variable where I can say that password for a vault must be at least 12 characters.
0 or not specified for the same behaviour as current.
Actual Result
Refuse password of length less than specified
Logs
No response
Screenshots or Videos
No response
Additional Context
NIST has recently updated guidelines with only the length left as constraint, see below for more
Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
Before the change : https://pages.nist.gov/800-63-3/sp800-63b.html
"Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. "
After the change: https://pages.nist.gov/800-63-4/sp800-63b.html
"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords."
So advice to requirement for this part, which is great!
@BlackDex commented on GitHub:
This is not something we can control at runtime. The defaults are backed in into the web-vault. And we do not want to divert too much from the Bitwarden defaults.