v1.0: Reject master keys with a size lower than 16 bytes

[maryamsulemani97]

• Master key must be composed of at least 16 bytes otherwise, Meilisearch will throw an error

To do

Some may be missing

• Update /learn/security/master_api_keys.md
• Update learn/configuration/instance_options.md#master-key

References

• Spec: Reject master keys shorter than 16 bytes in production specifications#209
• Issue on core: Reject master keys with a size lower than 16 bytes meilisearch#3272
• Product discussion: Avoid weak master key product#538
• SME: @dureuill

[maryamsulemani97]

@dureuill
Could you please clarify if it's 16 characters or 16 bytes?

[dureuill]

Hello @maryamsulemani97 👋

The implementation checks using String::len, so it is 16 bytes. I will try to clarify this in the command line interface messages and in the spec.

We could enforce 16 characters at the price of making the implementation more complex if needed.

[dureuill]

^

pinging @gmourier on this just to make sure we're aligned with product on the byte/character distinction and which one to choose for master key length

[gmourier]

Thanks @dureuill and @maryamsulemani97! Agreed with the 16 bytes minimum 🙇‍♂️