starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-26 09:46:00 +03:00

[GH-ISSUE #2419] Lack of validation on name of the users #1257

New issue

Closed

opened 2026-03-03 02:07:33 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 02:07:33 +03:00

Owner

Originally created by @pavel1337 on GitHub (Apr 14, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2419

Originally assigned to: @BlackDex on GitHub.

Subject of the issue

Lack of validation on name of the users

Deployment environment

vaultwarden version: 1.24.0
Install method: Docker (Base: Debian)
Clients used: web client
MySQL/MariaDB or PostgreSQL version: MySQL 8.0.23 RDS
Other relevant details:

Steps to reproduce

Receieve an invite to vaultwarden
Create account with long name (eg. using this command pwgen 100000 1)

Expected behaviour

validation error with something like "the name is too long"

Actual behaviour

I was able to create a user and login, but I cannot send secrets. I guess because the bearer token is too big, because the username is too long.

Troubleshooting data

The command I used to create a long username: pwgen 100000 1

The screenshot of the users table; I guess it should be something like varchar(x)

The screenshot of the organization with me in it:

The screenshot of me trying create a send and developer tools

Originally created by @pavel1337 on GitHub (Apr 14, 2022). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2419 Originally assigned to: @BlackDex on GitHub. ### Subject of the issue Lack of validation on name of the users ### Deployment environment * vaultwarden version: 1.24.0 * Install method: Docker (Base: Debian) * Clients used: web client * MySQL/MariaDB or PostgreSQL version: MySQL 8.0.23 RDS * Other relevant details: ### Steps to reproduce 1. Receieve an invite to vaultwarden 2. Create account with long name (eg. using this command ```pwgen 100000 1```) ### Expected behaviour - validation error with something like "the name is too long" ### Actual behaviour - I was able to create a user and login, but I cannot send secrets. I guess because the bearer token is too big, because the username is too long. ### Troubleshooting data The command I used to create a long username: ```pwgen 100000 1``` The screenshot of the users table; I guess it should be something like ```varchar(x)``` ![image](https://user-images.githubusercontent.com/31508908/163392934-38cf465f-262e-47d2-9ee2-789fa271dd0e.png) The screenshot of the organization with me in it: ![Screenshot 2022-04-14 at 14-20-33 People Bitwarden Web Vault (1)](https://user-images.githubusercontent.com/31508908/163393340-0620ba1f-d4c6-4d9c-979b-e7251f41b2d2.png) The screenshot of me trying create a send and developer tools ![image](https://user-images.githubusercontent.com/31508908/163394232-9d1903eb-9bc6-4f21-983c-33973fb13412.png)

kerem

2026-03-03 02:07:33 +03:00

closed this issue
added the
enhancement

low priority
labels

kerem commented

2026-03-03 02:07:34 +03:00

Author

Owner

@BlackDex commented on GitHub (Jun 4, 2022):

Looks like Bitwarden it self uses a max of 50 characters. It will be a bit difficult now to switch that for Vaultwarden to a lower size if people were already using a larger amount of characters for the names.
Though limiting it a specific amount is not a bad idea, i need to see what a good amount is.

@BlackDex commented on GitHub (Jun 4, 2022): Looks like Bitwarden it self uses a max of 50 characters. It will be a bit difficult now to switch that for Vaultwarden to a lower size if people were already using a larger amount of characters for the names. Though limiting it a specific amount is not a bad idea, i need to see what a good amount is.

kerem commented

2026-03-03 02:07:34 +03:00

Author

Owner

@dani-garcia commented on GitHub (Jun 4, 2022):

We could just limit it in the save function, if we don't want to create a new migration for this change

@dani-garcia commented on GitHub (Jun 4, 2022): We could just limit it in the save function, if we don't want to create a new migration for this change

kerem commented

2026-03-03 02:07:34 +03:00

Author

Owner

@BlackDex commented on GitHub (Jun 8, 2022):

I think it should be enough to have this only at the register function, what do you think @dani-garcia ?
That would at least prevent new users from using a large Name, but will not force current users to change it when they update there info.

btw: i have it working already locally.

@BlackDex commented on GitHub (Jun 8, 2022): I think it should be enough to have this only at the register function, what do you think @dani-garcia ? That would at least prevent new users from using a large Name, but will not force current users to change it when they update there info. btw: i have it working already locally.

kerem commented

2026-03-03 02:07:34 +03:00

Author

Owner

@dani-garcia commented on GitHub (Jun 8, 2022):

Right, but a user could also change their name from the web vault after the account was created, I know realistically no one is going to put a long enough name to break the web vault, but we should cover all bases if possible.

@dani-garcia commented on GitHub (Jun 8, 2022): Right, but a user could also change their name from the web vault after the account was created, I know realistically no one is going to put a long enough name to break the web vault, but we should cover all bases if possible.

kerem referenced this issue

2026-03-03 09:08:59 +03:00

[PR #1257] [MERGED] Validate cipher updates with revision date #2930