Identity ignoring RequiredLength

[naamor]

I used ASP.NET 5 MVC 6 (1.0.0-rc1-update1) "Web Application" Template with "Individual User Accounts" and changed default password requirements to:

options.Password.RequireDigit = false; options.Password.RequireLowercase = false; options.Password.RequireUppercase = false; options.Password.RequireNonLetterOrDigit = false; options.Password.RequiredLength = 12;

Everything works fine, except RequiredLength.

• When RequiredLength is lower than 6, the register form always shows "The Password must be at least 6 characters long.".
• Is RequiredLength higher than 6, and the input lenght between 6 and the defined number (12), I get "Passwords must be at least 12 characters.", is the input lenght lower than 6 the form shows the error from above.

[HaoK]

This is because the validation of the form is not tied to the underlying identity code... The validator length is controlled by the View model, see

https://github.com/aspnet/Templates/blob/dev/src/Rules/StarterWeb/IndividualAuth/Models/AccountViewModels/RegisterViewModel.cs#L17

[divega]

@HaoK doesn't this mean that there is a bug in the template?

[HaoK]

The data validation attributes in templates cannot easily share identity configuration. Since the template hardcodes a required length of 6 by default. It needs to be manually changed to match whatever the new required length is to match identity.

[divega]

What I mean is: should we propose that we remove this attribute from the template?

[HaoK]

Then there would be no client side validation for the for the password length which seems weird.