Password validation rules differ between the iOS client and backend
Type: Validation · Functional
- Severity
- Medium
- Priority
- Medium
- Build
- TestFlight 1.1 (1)
- Environment
- iPhone 17 · iOS 26.5
Preconditions
Registration screen is open. Swagger UI is available for POST /api/v1/auth/register.
Steps to reproduce
- On iOS, enter a valid email and a 4-character password (e.g.
Ab12) - Submit registration — the client shows an alert: password must be at least 8 characters
- Send the same payload to
POST /api/v1/auth/registerin Swagger UI
Expected
The same password rule on client and server. If the UI requires 8 characters, the API should reject a 4-character password too.
Actual
The backend accepts a 4-character password that the iOS client rejects.
Finding Client-side validation and server-side validation enforce different password requirements.