Description

There is UI discrepancy in the user password section in nakama console. The UI presents the following message to the user for a short password: "Password is required, must be 8 chars or longer and consist of at least a capital letter, a small letter and a number". However, the backend accepts a password with just 6 characters which can be seen in the following response from the server.

HTTP Request

POST /v2/console/user HTTP/1.1
Host: 192.168.1.16:7351
Authorization: Bearer <token>
Cookie: <cookies>

{"username":"test","email":"test@example.com","password":"Abc123","role":4,"newsletter_subscription":false}

The request sends a password of just 6 characters and still the user account is created.

Impact

The user interface provides feedback that causes the user to believe that the feature is in a secure state, although it is not working as intended securely.