From f8c429f217fbda8c026a89cc7ae61a30aba37685 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:09:11 +0100
Subject: [PATCH] fix: re-prompt for a pasted session secret under 32
 characters in setup.sh, which broke admin sign-in and remember-me

---
 setup.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/setup.sh b/setup.sh
index b7e153160..b7c66ff59 100644
--- a/setup.sh
+++ b/setup.sh
@@ -692,6 +692,11 @@ screen_security_config() {
             fi
         else
             prompt_value "Session secret (paste your own)" "" "CFG_SESSION_SECRET"
+            # Admin sign-in and "Remember me" refuse a secret under 32 characters
+            while [[ -n "$CFG_SESSION_SECRET" && ${#CFG_SESSION_SECRET} -lt 32 ]]; do
+                echo -e "    ${RED}The session secret needs at least 32 characters. Leave it empty to go without one.${RESET}"
+                prompt_value "Session secret (paste your own)" "" "CFG_SESSION_SECRET"
+            done
         fi
     else
         echo -e "    ${OK} Session secret is already configured"