Signup rejects a valid 8-character password

Nobody has started this yet — be first.

Business impact

Support gets a slow trickle of "your signup form is broken" tickets from users who read "at least 8 characters," typed exactly 8, and got rejected anyway with a message that contradicts what just happened. It is not a security hole, but it is the kind of paper-cut that erodes trust in the product on the very first screen a new user sees, and every occurrence is a support contact that did not need to happen.

Problem

signup() is supposed to enforce "password must be at least 8 characters," but its guard rejects a password of exactly 8 characters even though the error message it returns says the 8-character password should have been fine.

Current behavior

The guard is if len(password) <= 8:, which rejects a password of exactly 8 characters -- an off-by-one against the documented rule, which allows exactly 8 as the minimum.

Expected behavior

A password of exactly 8 characters is accepted by POST /auth/signup. Only passwords of 7 characters or fewer are rejected with 400.

Steps to reproduce

POST /auth/signup with {"email":"boundary@example.com","password":"abcd1234"}.
Observe: 400 {"error": "password must be at least 8 characters"}.
"abcd1234" is 8 characters -- it should have been accepted (201).

Why this matters

Boundary conditions on < vs <= are one of the single most common off-by-one mistakes in real codebases -- exactly because the code still "looks right" at a glance and every non-boundary test case passes.

Suggested approach

Look at the exact comparison operator in signup()'s password-length check. Compare it against the stated rule ("at least 8 characters") and against the other password-length check in this same file (password_reset_confirm()) -- one of the two is written correctly.

Acceptance criteria

A password of exactly 8 characters is accepted by POST /auth/signup
A password of 7 characters or fewer is still rejected with 400
tests/test_signup_login.py::test_signup_rejects_short_password (existing suite) still passes

Verification

pytest practice_tickets/tests/test_ticket_01.py -v

Hints (0/2)

Try it without hints first — the reading is the exercise.

Working on this ticket

Work on a branch named for the ticket — that's what you'll submit.

Branch off your fork

$git checkout -b fix/signup-password-boundary

Fix it and commit

Meet every acceptance criterion, and add a test that would have caught this.

Push the branch

$git push -u origin fix/signup-password-boundary

Submit it below

Paste your fork URL and the branch name, with a short write-up of the root cause.

Submit your fix

Questions

Stuck on something?

Ask about anything unclear in the ticket — the maintainer and anyone who has solved it can answer. Please don't post full solutions.

No questions yet. If something in this ticket reads ambiguously, you are probably not the only one — ask.

The project

Production-Style Flask Auth Service

A from-scratch Flask authentication service: JWT access + refresh tokens with rotation and reuse detection, real session/device revocation, password reset, email verification, and TOTP 2FA with backup codes.

Fork on GitHub

Download

Setup

Production-Style Flask Auth Service

git clone <your-fork>
cd FlaskDevTraining/flask_auth_service
cp .env.example .env
make docker-up   # docker compose up --build: Postgres + Redis + Flask dev server

Migrations run automatically on container start. The app is reachable at . Seed two demo users (one plain, one with 2FA already enabled) with -- it prints the 2FA user's TOTP secret, provisioning URI, and a one-liner to compute a current code with , so the 2FA flow is fully testable without an authenticator app. A production-style path with gunicorn (no dev server, no bind mount) is available via .