Changes between Version 11 and Version 12 of SecurityTeam

Timestamp:

Nov 21, 2025, 6:15:37 AM (2 weeks ago)

Author:

Natalia Bidart

Comment:

Add common response for "lack of maximum length for passwords"

SecurityTeam

@@ -47 +47 @@
 Thanks for your understanding!
 
+Kind regards, the Django Security Team.
+
 === Unsanitized user input ===
+
 After review, we've determined that the reported issue only affects workflows that process user input without sanitization. As documented at [0]:
 
@@ -58 +61 @@
 Thanks for taking the time to submit it through the appropriate channel.
 
+Kind regards, the Django Security Team.
+
 === Private API ===
+
 After review, we've determined that the reported issue only affects direct usage of private, undocumented functionality. As documented at [0]:
 
@@ -68 +74 @@
 
 Thanks for taking the time to submit it through the appropriate channel.
+
+Kind regards, the Django Security Team.
 
 === Security issue in the development server (runserver) ===
@@ -83 +91 @@
 Thanks for taking the time to submit it through the appropriate channel.
 
+Kind regards, the Django Security Team.
+
 [0] https://docs.djangoproject.com/en/stable/ref/django-admin/#django-admin-runserver
-
 [1] https://docs.djangoproject.com/en/stable/internals/security/#how-does-django-evaluate-a-report
 
@@ -103 +112 @@
 For further clarification, please see our documentation on performing raw SQL queries: https://docs.djangoproject.com/en/stable/topics/db/sql/#performing-raw-sql-queries
 
-Best,
-Django Security Team.
+Kind regards, the Django Security Team.
+
+=== Maximum password validator (lack of) ==
+
+Thank you for your report. We reviewed the issue and do not consider it a security vulnerability.
+
+While it is true that extremely long passwords could, in theory, increase the cost of password hashing, Django applies a request body size limit [0], which defaults to 2.5 MB. In practice, this means passwords cannot exceed roughly 2.5 million characters.Django's built-in password hashers handle inputs of this size efficiently. On a regular desktop machine, hashing a 2.5 MB password takes on the order of a third of a second.
+
+For example, running the following plain Python script:
+{{{#!python
+import timeit
+from django.contrib.auth.hashers import get_hasher
+
+hasher = get_hasher()
+salt = hasher.salt()
+password = "x" * 2_621_440  # ~2.5 MB
+n = 5  # number of runs
+total_seconds = timeit.timeit(lambda: hasher.encode(password, salt), number=n)avg_ms = (total_seconds / n) * 1000
+
+print(f"Average time: {avg_ms:.2f} ms over {n} runs")
+}}}
+Produces output such as: `Average time: 281.13 ms over 5 runs`
+
+Given these limits and performance characteristics, and noting that it is generally good practice to permit long and secure passwords, we do not consider any change necessary in Django itself.
+
+Kind regards, The Django Security Team.
+
+[0] https://docs.djangoproject.com/en/stable/ref/settings/#data-upload-max-memory-size
 
 === Unauthenticated cache purge ===