Password restrictions

Set the minimum and maximum length of local passwords on a Kubernetes deployment.

The web service checks local passwords when users register, set or change a password. SSO logins (LDAP, SAML, OIDC) are not affected; their passwords are the identity provider’s business. See Password restrictions for the Toolkit.

Service	web, in every Ayakaleaf Pro pod; read when web starts
Network	none
Periodic jobs	none

Configuration

Add to the ConfigMap overleaf-env and restart:

30-config.yaml (additions)

  OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH: "12"
  OVERLEAF_PASSWORD_VALIDATION_MAX_LENGTH: "72"

kubectl apply -f 30-config.yaml
kubectl -n overleaf rollout restart deployment/overleaf     # or statefulset/overleaf

Variable	Default
OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH	8	Shortest password accepted.
OVERLEAF_PASSWORD_VALIDATION_MAX_LENGTH	72	Longest password accepted; values above 72 are treated as 72.

Quote the numbers: a ConfigMap only holds strings.

OVERLEAF_PASSWORD_VALIDATION_PATTERN is read but not enforced: a password that does not match it is accepted. Only the length limits apply.

Several replicas

Nothing extra: every replica reads the same ConfigMap.

Tested on Kubernetes

On Kubernetes 1.37 with one replica, OVERLEAF_PASSWORD_VALIDATION_MIN_LENGTH: "12" and OVERLEAF_PASSWORD_VALIDATION_PATTERN: aA$3 in the ConfigMap, activating a new account refused a 10-character password and accepted a 20-character password of lowercase letters only, which the pattern would have refused. Our end-to-end tests for registration also refuse 123456 as too short with the defaults.