5 ms·
I created an account for a 401k vendor that our company recently switched to. During the registration process I used a password manager to generate a 14 digit
by drakenot 8y ago
I created an account for a 401k vendor that our company recently switched to. During the registration process I used a password manager to generate a 14 digit random password.
Imagine my surprise when I went to login to the newly created account only to find out that the login screen enforced a character limit of 8 characters (both with a textfield attribute and js). This limitation was not enforced during registration!
I had to edit the page in developer tools so I could actually paste my full password to login. The limitation was purely client side.
- retrodpc 8y agoOuch. So the server still accepted the 14-char password, even if the login page didn't allow it?
- amarant 8y agohaha whaat? they had a limit of 8 chars MAXIMUM? that's usually the minimum limitation! at least they had implemented the first rule of it-security: perform all checks client-side only ;)