diff --git a/plugins/restful/normal_handle.c b/plugins/restful/normal_handle.c
index 1275f212..52fb800a 100644
--- a/plugins/restful/normal_handle.c
+++ b/plugins/restful/normal_handle.c
@@ -54,12 +54,20 @@ void handle_login(nng_aio *aio)
         aio, neu_json_login_req_t, neu_json_decode_login_req, {
             neu_json_login_resp_t login_resp = { 0 };
             neu_user_t *          user       = neu_load_user(req->name);
+            int                   pass_len   = strlen(req->pass);
 
             if (NULL == user) {
                 nlog_error("could not find user `%s`", req->name);
                 NEU_JSON_RESPONSE_ERROR(NEU_ERR_INVALID_USER_OR_PASSWORD, {
                     neu_http_response(aio, error_code.error, result_error);
                 });
+            } else if (pass_len < NEU_USER_PASSWORD_MIN_LEN ||
+                       pass_len > NEU_USER_PASSWORD_MAX_LEN) {
+                nlog_error("user `%s` password too short or too long",
+                           req->name);
+                NEU_JSON_RESPONSE_ERROR(NEU_ERR_INVALID_PASSWORD_LEN, {
+                    neu_http_response(aio, error_code.error, result_error);
+                });
             } else if (neu_user_check_password(user, req->pass)) {
 
                 char *token  = NULL;