langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Password policy conflict with temporary password format in self-hosted environment #6858

New Issue
Closed
opened 2026-02-21 18:17:37 -05:00 by yindo · 5 comments
yindo commented 2026-02-21 18:17:37 -05:00
Owner
Copy Link
Copy Source

Originally created by @tubone24 on GitHub (Nov 20, 2024).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

0.11.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

When trying to reset password in self-hosted environment, I encountered an issue with the password policy validation.

  • Deploy Dify in self-hosted environment
  • Request a password reset
  • Receive temporary password via email
  • Try to use the temporary password
  • Get rejected by password policy validation

スクリーンショット 2024-11-20 23 05 29
スクリーンショット 2024-11-20 22 55 49

✔️ Expected Behavior

The temporary password format should comply with the password policy requirements, or the policy should be temporarily bypassed during the password reset process.

❌ Actual Behavior

  • The temporary password sent via email is a 6-digit numeric code
  • The password policy requires both letters and numbers, with a minimum length of 8 characters
  • This causes the temporary password to be rejected by the system's password policy
Originally created by @tubone24 on GitHub (Nov 20, 2024). ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version 0.11.0 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce When trying to reset password in self-hosted environment, I encountered an issue with the password policy validation. - Deploy Dify in self-hosted environment - Request a password reset - Receive temporary password via email - Try to use the temporary password - Get rejected by password policy validation ![スクリーンショット 2024-11-20 23 05 29](https://github.com/user-attachments/assets/63143222-6e55-4050-849a-5926effe57b6) ![スクリーンショット 2024-11-20 22 55 49](https://github.com/user-attachments/assets/d96f9b69-ed90-40ce-9a5b-1d6c53269d5e) ### ✔️ Expected Behavior The temporary password format should comply with the password policy requirements, or the policy should be temporarily bypassed during the password reset process. ### ❌ Actual Behavior - The temporary password sent via email is a 6-digit numeric code - The password policy requires both letters and numbers, with a minimum length of 8 characters - This causes the temporary password to be rejected by the system's password policy
yindo closed this issue 2026-02-21 18:17:37 -05:00
yindo commented 2026-02-21 18:17:38 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 20, 2024):

The issue you're experiencing arises because the temporary password sent during the password reset process is a 6-digit numeric code, which does not meet the password policy requirements of containing both letters and numbers and being at least 8 characters long. This results in the temporary password being rejected by the system's password policy.

To resolve this, there are a couple of potential solutions:

  1. Adjust the Temporary Password Format: Modify the format of the temporary password to ensure it complies with the existing password policy. This would involve generating a temporary password that includes both letters and numbers and is at least 8 characters long.

  2. Bypass the Password Policy Temporarily: Implement a mechanism to bypass the password policy validation specifically for the temporary password during the reset process. This would allow the current format to be used without being rejected.

These changes would need to be implemented in the codebase to ensure that the temporary password aligns with the password policy or is exempt from it during the reset process.

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Nov 20, 2024): <!-- Answer --> The issue you're experiencing arises because the temporary password sent during the password reset process is a 6-digit numeric code, which does not meet the password policy requirements of containing both letters and numbers and being at least 8 characters long. This results in the temporary password being rejected by the system's password policy. To resolve this, there are a couple of potential solutions: 1. **Adjust the Temporary Password Format**: Modify the format of the temporary password to ensure it complies with the existing password policy. This would involve generating a temporary password that includes both letters and numbers and is at least 8 characters long. 2. **Bypass the Password Policy Temporarily**: Implement a mechanism to bypass the password policy validation specifically for the temporary password during the reset process. This would allow the current format to be used without being rejected. These changes would need to be implemented in the codebase to ensure that the temporary password aligns with the password policy or is exempt from it during the reset process. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:17:38 -05:00
Author
Owner
Copy Link
Copy Source

@tubone24 commented on GitHub (Nov 20, 2024):

@dosu

Bypass the Password Policy Temporarily: Implement a mechanism to bypass the password policy validation specifically for the temporary password during the reset process. This would allow the current format to be used without being rejected.

Good Idea. Please explain how to implement it while specifically pointing out the components that need to be modified.

@tubone24 commented on GitHub (Nov 20, 2024): @dosu > Bypass the Password Policy Temporarily: Implement a mechanism to bypass the password policy validation specifically for the temporary password during the reset process. This would allow the current format to be used without being rejected. Good Idea. Please explain how to implement it while specifically pointing out the components that need to be modified.
yindo commented 2026-02-21 18:17:38 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Nov 20, 2024):

To implement a mechanism to bypass the password policy temporarily during the reset process, you can follow these steps:

  1. Identify the Validation Logic: The password policy validation logic is implemented in the ChangePasswordForm component, specifically within the valid function. This function checks if the password meets the policy requirements [1].

  2. Modify the Validation Logic: You need to adjust this logic to allow the temporary password to bypass the policy. This can be done by adding a condition to check if the password being validated is the temporary password. If it is, you can skip the validation checks.

  3. Determine Temporary Password: Ensure you have a way to identify the temporary password. This could be done by checking if the password matches the format of the temporary password (e.g., a 6-digit numeric code).

  4. Implement the Bypass: Modify the valid function to include a condition that checks if the password is the temporary one. If it is, return true without performing the usual validation. Here's a conceptual example:

    const valid = useCallback(() => {
  if (isTemporaryPassword(password)) {
    return true; // Bypass validation for temporary password
  }
  if (!password.trim()) {
    showErrorMessage(t('login.error.passwordEmpty'));
    return false;
  }
  if (!validPassword.test(password)) {
    showErrorMessage(t('login.error.passwordInvalid'));
    return false;
  }
  if (password !== confirmPassword) {
    showErrorMessage(t('common.account.notEqual'));
    return false;
  }
  return true;
}, [password, confirmPassword, showErrorMessage, t]);

const isTemporaryPassword = (password) => {
  return /^\d{6}$/.test(password); // Example check for 6-digit numeric code
};

  5. Test the Changes: After implementing the changes, thoroughly test the password reset process to ensure that the temporary password is accepted and that the regular password policy is enforced for other passwords.

By following these steps, you can allow the temporary password to bypass the policy validation during the reset process.

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Nov 20, 2024): <!-- Answer --> To implement a mechanism to bypass the password policy temporarily during the reset process, you can follow these steps: 1. **Identify the Validation Logic**: The password policy validation logic is implemented in the `ChangePasswordForm` component, specifically within the `valid` function. This function checks if the password meets the policy requirements <sup>[[1]](https://github.com/langgenius/dify/blob/main/web/app/forgot-password/ChangePasswordForm.tsx)</sup>. 2. **Modify the Validation Logic**: You need to adjust this logic to allow the temporary password to bypass the policy. This can be done by adding a condition to check if the password being validated is the temporary password. If it is, you can skip the validation checks. 3. **Determine Temporary Password**: Ensure you have a way to identify the temporary password. This could be done by checking if the password matches the format of the temporary password (e.g., a 6-digit numeric code). 4. **Implement the Bypass**: Modify the `valid` function to include a condition that checks if the password is the temporary one. If it is, return `true` without performing the usual validation. Here's a conceptual example: ```tsx const valid = useCallback(() => { if (isTemporaryPassword(password)) { return true; // Bypass validation for temporary password } if (!password.trim()) { showErrorMessage(t('login.error.passwordEmpty')); return false; } if (!validPassword.test(password)) { showErrorMessage(t('login.error.passwordInvalid')); return false; } if (password !== confirmPassword) { showErrorMessage(t('common.account.notEqual')); return false; } return true; }, [password, confirmPassword, showErrorMessage, t]); const isTemporaryPassword = (password) => { return /^\d{6}$/.test(password); // Example check for 6-digit numeric code }; ``` 5. **Test the Changes**: After implementing the changes, thoroughly test the password reset process to ensure that the temporary password is accepted and that the regular password policy is enforced for other passwords. By following these steps, you can allow the temporary password to bypass the policy validation during the reset process. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:17:38 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Nov 20, 2024):

This is a one time password for validating this account that belongs to you.

You need to input the code here in this step.

image

After that, you can setup your own password which should follow that password policy.

@crazywoola commented on GitHub (Nov 20, 2024): This is a one time password for validating this account that belongs to you. You need to input the code here in this step. <img width="655" alt="image" src="https://github.com/user-attachments/assets/f5abca66-ccdc-4a98-a439-e210c51a9abb"> After that, you can setup your own password which should follow that password policy.
yindo commented 2026-02-21 18:17:38 -05:00
Author
Owner
Copy Link
Copy Source

@tubone24 commented on GitHub (Nov 21, 2024):

@crazywoola

Thank you for your response. While I understand this is a one-time password format, after sending the reset link, I'm unsure which screen I should navigate to in order to enter the code (I'm not clear about the screen you introduced).
As shown in the attachment, the reset link sending screen only has a "Return to Sign in" button, and there is no corresponding link in the email content.
I believe I should be able to proceed if I can access the screen at https://github.com/langgenius/dify/blob/82575a7aea904c0c56f8103fe0ceea39e97cf0f4/web/app/signin/check-code/page.tsx#L72, but I'm having trouble because directly accessing the URL results in a 404 error.

スクリーンショット 2024-11-21 18 37 48

スクリーンショット 2024-11-21 18 44 08

@tubone24 commented on GitHub (Nov 21, 2024): @crazywoola Thank you for your response. While I understand this is a one-time password format, after sending the reset link, I'm unsure which screen I should navigate to in order to enter the code (I'm not clear about the screen you introduced). As shown in the attachment, the reset link sending screen only has a "Return to Sign in" button, and there is no corresponding link in the email content. I believe I should be able to proceed if I can access the screen at https://github.com/langgenius/dify/blob/82575a7aea904c0c56f8103fe0ceea39e97cf0f4/web/app/signin/check-code/page.tsx#L72, but I'm having trouble because directly accessing the URL results in a 404 error. ![スクリーンショット 2024-11-21 18 37 48](https://github.com/user-attachments/assets/406d77fd-798c-421e-9668-fa67e7ab9a1e) ![スクリーンショット 2024-11-21 18 44 08](https://github.com/user-attachments/assets/34e602a6-0f66-4f3a-9fb8-cfeaa4781e88)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#6858
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?