Peter deHaan [:pdehaan] Reporter
	Description • 11 years ago

Steps to reproduce:
1. Download and install http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/nalexander@mozilla.com-60c48d4ed251/try-android/
2. Goto (Android) Settings > Accounts > Add account > Firefox Account
3. Enter a valid email address format (peter@foo.com)
4. Enter a short password "ab".
5. Click the Create Account button.


Actual results:
Account is seemingly created with an invalid password length.


Expected results:
We should validate password length locally before sending to server and display a solid error message.

	Richard Newman [:rnewman]
	Comment 1 • 11 years ago

Chris, is there a defined minimum password length for FxA?

	Chris Karlof [:ckarlof]
	Comment 2 • 11 years ago

8 character minimum. No additional restrictions.

	Chris Karlof [:ckarlof]
	Comment 3 • 11 years ago

Tracking issue for FxA for the Web: https://github.com/mozilla/fxa-content-server/issues/110

	Nick Alexander :nalexander [he/him] (PTO until Montreallhands August 21, 2023)
	Comment 4 • 11 years ago

Should be fixed by Bug 951304.  QA verification appreciated.

On create, the button should be disabled until the password is >= 8 characters long.  When signing in, the button should be disabled until the password is >= 1 character long.  This choice was made because the mocks I have don't show text about password length on sign in, and it's very strange to not have the button enabled immediately.

	ewong
	Comment 5 • 11 years ago

I thought we also had a 64 char max limit?

	Richard Newman [:rnewman]
	Comment 6 • 11 years ago

"No additional restrictions." -- does that mean no max length?

	Chris Karlof [:ckarlof]
	Comment 7 • 11 years ago

(In reply to Richard Newman [:rnewman] from comment #6)
> "No additional restrictions." -- does that mean no max length?

We could consider doing that, but we send over a fixed length hash of the password to the FxA auth server, so there aren't DOS issues related to long passwords.

I don't see much upside in a max password length restriction at this point, other than preventing the user from creating a bad UX for themselves by choosing a 1000 char password.