As title suggests...
I found sources stating password character limit being 512, but unable to find any info on username length limit.
#ACL Username max character length
frail spindle
karmic vector
As title suggests...
I found sources stating password character limit being 512...
Technically server is not limiting the size of neither user name nor user password. The specific clients might have limitations, like you got 512 bytes in a client (which one?).
Server code: https://github.com/redis/redis/blob/ecc31bc6973830c8aa9747471943f1bdd46f3257/src/acl.c#L439
Also: https://redis.io/docs/management/security/acl/
However ACL passwords are not really passwords. They are shared secrets between the server and the client, because the password is not an authentication token used by a human being. For instance:
There are no length limits, the password will just be memorized in some client software. There is no human that needs to recall a password in this context.
The ACL password does not protect any other thing. For example, it will never be the password for some email account.
Often when you are able to access the hashed password itself, by having full access to the Redis commands of a given server, or corrupting the system itself, you already have access to what the password is protecting: the Redis instance stability and the data it contains.
Max len for password was for the old password method, as described here: https://github.com/redis/redis/issues/3307#issuecomment-225655956. I thought that applied to ACL as well.
Tq for the info.
