What problem did you meet?
Description
We are using the official Logto Docker image ghcr.io/logto-io/logto:latest in a self-hosted environment. We need to allow usernames that contain dots (.) and hyphens (-), e.g., john.doe or user-name.
Currently, the username validation regex does not allow these characters.
Environment
Docker image: ghcr.io/logto-io/logto:latest
Logto version: 1.38.0
Deployment: Docker Compose on Synology NAS
Database: PostgreSQL 17
Cache: Redis 7
Current Behavior
When trying to create a user with a username containing a dot or hyphen (e.g., john.doe), the validation fails with:
Client-side error in the Admin Console: username_invalid_charset
Server-side validation rejects the request
Expected Behavior
Usernames should allow dots (.) and hyphens (-) as valid characters. For example:
john.doe
user-name
john.doe123
user-name_123
What We've Tried
We have identified the location of the username validation in the source code:
File: packages/toolkit/core-kit/src/regex.ts (line 6)
Current regex:
typescript
export const usernameRegEx = /^[A-Z_a-z]\w*$/;
We found that modifying the regex in the running container fixes the issue:
typescript
export const usernameRegEx = /^A-Za-z0-9?$/;
Since we are using the official Docker image (not building from source), we currently need to patch the file inside the container and mount the modified version:
bash
Modified regex.js file mounted via docker-compose
volumes:
- ./patched-regex.js:/etc/logto/packages/toolkit/core-kit/lib/regex.js:ro
- ./patched-index.js:/etc/logto/static/console/assets/index-BIGee9c4.js:ro
Question / Feature Request
Is there an official way to customize the username validation regex via environment variables or configuration without modifying the source code?
If not, could the Logto team consider adding an environment variable like USERNAME_REGEX to allow administrators to customize username validation?
Would the Logto team consider updating the default username validation to allow dots and hyphens for better compatibility with common naming conventions?
Related Issues
I found issue #8617 which requests support for Chinese characters in usernames. The root cause is the same restrictive regex. The suggested solution there also points to modifying the same regex.ts file.
Additional Context
In our organization, usernames often contain dots (e.g., firstname.lastname) which is a common pattern. The current restriction forces us to use alternative naming conventions or maintain custom patches that may break when updating the Logto Docker image.
Describe what you'd like Logto to have
Allow dots (.) and hyphens (-) in usernames by default, or provide a configuration option (e.g., environment variable USERNAME_REGEX) to customize the username validation pattern without modifying source code.
Currently, the regex is hardcoded as /^[A-Z_a-z]\w*$/ in packages/toolkit/core-kit/src/regex.ts. This prevents common username patterns like firstname.lastname or user-name.
Suggested regex that allows dots and hyphens while maintaining security:
/^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/
For Docker users (like us using ghcr.io/logto-io/logto:latest), being able to configure this via an environment variable would eliminate the need to maintain custom patches that break on updates.
What problem did you meet?
Description
We are using the official Logto Docker image ghcr.io/logto-io/logto:latest in a self-hosted environment. We need to allow usernames that contain dots (.) and hyphens (-), e.g., john.doe or user-name.
Currently, the username validation regex does not allow these characters.
Environment
Docker image: ghcr.io/logto-io/logto:latest
Logto version: 1.38.0
Deployment: Docker Compose on Synology NAS
Database: PostgreSQL 17
Cache: Redis 7
Current Behavior
When trying to create a user with a username containing a dot or hyphen (e.g., john.doe), the validation fails with:
Client-side error in the Admin Console: username_invalid_charset
Server-side validation rejects the request
Expected Behavior
Usernames should allow dots (.) and hyphens (-) as valid characters. For example:
john.doe
user-name
john.doe123
user-name_123
What We've Tried
We have identified the location of the username validation in the source code:
File: packages/toolkit/core-kit/src/regex.ts (line 6)
Current regex:
typescript
export const usernameRegEx = /^[A-Z_a-z]\w*$/;
We found that modifying the regex in the running container fixes the issue:
typescript
export const usernameRegEx = /^A-Za-z0-9?$/;
Since we are using the official Docker image (not building from source), we currently need to patch the file inside the container and mount the modified version:
bash
Modified regex.js file mounted via docker-compose
volumes:
Question / Feature Request
Is there an official way to customize the username validation regex via environment variables or configuration without modifying the source code?
If not, could the Logto team consider adding an environment variable like USERNAME_REGEX to allow administrators to customize username validation?
Would the Logto team consider updating the default username validation to allow dots and hyphens for better compatibility with common naming conventions?
Related Issues
I found issue #8617 which requests support for Chinese characters in usernames. The root cause is the same restrictive regex. The suggested solution there also points to modifying the same regex.ts file.
Additional Context
In our organization, usernames often contain dots (e.g., firstname.lastname) which is a common pattern. The current restriction forces us to use alternative naming conventions or maintain custom patches that may break when updating the Logto Docker image.
Describe what you'd like Logto to have
Allow dots (.) and hyphens (-) in usernames by default, or provide a configuration option (e.g., environment variable
USERNAME_REGEX) to customize the username validation pattern without modifying source code.Currently, the regex is hardcoded as
/^[A-Z_a-z]\w*$/inpackages/toolkit/core-kit/src/regex.ts. This prevents common username patterns likefirstname.lastnameoruser-name.Suggested regex that allows dots and hyphens while maintaining security:
/^[A-Za-z0-9]([A-Za-z0-9._-]*[A-Za-z0-9])?$/For Docker users (like us using
ghcr.io/logto-io/logto:latest), being able to configure this via an environment variable would eliminate the need to maintain custom patches that break on updates.