3 ms·

Just hash raw bytes. Treat it as data and set a maximum byte limit.

• Nextgrid 4y ago
  Indeed, this is the correct solution. Even if you assume that a user has a broken setup that somehow submits weird characters, you're still better off accepting it so that at least they can continue to log in using that weird setup, as opposed to trying to "correct" it and potentially locking the user out.
  • Ekaros 4y ago
    Just be sure there is some mechanism in place to reset the password. As they might then have issue with different platforms. And also ensure if you support multiple platforms there isn't clear operating difference in between.
• rzzzwilson 4y ago
  Why a "maximum limit"?
  • ev1 4y ago
    DOS/resource exhaustion. It doesn't need to be something dumb like 24 characters.
  • Ekaros 4y ago
    You don't want someone to use password that is millions or billions code-points in length. Technically in spec, but utterly stupid and useless. Just don't go too low.