[Bug]: Cannot signup

[luckkmaxx]

Description

Cannot signup for first time:

ValueError: password cannot be longer than 72 bytes, truncate manually if necessary (e.g. my_password[:72])

Steps to Reproduce

Run containers as is
Go to localhost:8080 and create admin user
"internal server error"

Expected Behavior

Start session after creating admin user

Deployment Method

Docker Compose

CashPilot Version

latest

Architecture

amd64 (x86_64)

Relevant Logs

ValueError: password cannot be longer than 72 bytes, truncate manually if necessary (e.g. my_password[:72])

Checks

• I am using the latest version of CashPilot
• I searched existing issues and this is not a duplicate

[GeiserX]

Thanks for reporting this!

The previous fix truncated passwords by characters (password[:72]), but bcrypt's 72-byte limit is on UTF-8 encoded bytes. Passwords with multi-byte characters (accents, emoji, CJK) could still exceed 72 bytes after encoding, triggering the ValueError on bcrypt ≥4.1 strict backends.

Fixed in 7a58e1d — now truncates by UTF-8 bytes:

bcrypt.hash(password.encode("utf-8")[:72])

The fix will be in the next Docker Hub image build (:latest tag). You can pull the updated image once CI completes:

docker pull drumsergio/cashpilot:latest

[luckkmaxx]

Thanks! Sadly Im in the same situation after pulling

[GeiserX]

I'm releasing a new version right now. try when I comment here again please, and if not, please be more verbose so I know the exact steps where this is failing (also please remove the DB data so we make sure its actually an issue). Sorry for the inconveniences @luckkmaxx

[GeiserX]

This is now fully fixed in v0.2.70 (PR #16).

Root Cause

passlib 1.7.4 (unmaintained since 2020) runs an internal self-test that sends a 255-byte password to bcrypt.hashpw(). The bcrypt Python package v5.0+ strictly rejects passwords >72 bytes. This crashes on the first call regardless of your actual password length — every user is affected.

What Changed

• Dropped passlib entirely — replaced with direct bcrypt library calls. Existing password hashes ($2b$ format) remain fully compatible.
• Security hardening: XSS fixes, SSRF protection, security headers, secure cookie flag, username validation, password minimum raised to 8 chars.
• 15 new auth tests covering password hashing, bcrypt truncation edge cases, and session tokens.

How to Update

docker pull drumsergio/cashpilot:latest
# or pin to the specific version:
docker pull drumsergio/cashpilot:v0.2.70

Then restart your container. No data migration needed — existing accounts will work as before.

Closing this issue. Thanks for the report @luckkmaxx!