Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

📋 refactor: allow paste in confirm field when resetting passwords #2542

Merged
merged 2 commits into from
Apr 26, 2024

Conversation

dahlo
Copy link
Contributor

@dahlo dahlo commented Apr 25, 2024

Summary

I've simply commented out the section where paste prevention is defined. Not allowing users to paste passwords makes it harder to use long passwords from password managers that are not browser plugins (e.g. keepass). NIST says it better than me,

NIST SP 800-53B, Section 5.1.1.2, Paragraph 10

Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets.

https://pages.nist.gov/800-63-3/sp800-63b.html

Change Type

  • New feature (non-breaking change which adds functionality)

Testing

In the deploy-compose.yml file, change the api service to build a image locally rather than pulling ghcr.io/danny-avila/librechat-dev-api:latest.
Start the containers, ask to reset the password of your user, click the link in the mail you get, and try to paste your password into both fields. Previously you could only paste into the "Password" field, and not the "Confirm password" field.

Checklist

Please delete any irrelevant options.

  • My code adheres to this project's style guidelines
  • I have performed a self-review of my own code
  • I have commented in any complex areas of my code
  • I have made pertinent documentation changes
  • My changes do not introduce new warnings
  • I have written tests demonstrating that my changes are effective or that my feature works
  • Local unit tests pass with my changes
  • Any changes dependent on mine have been merged and published in downstream modules.
  • New documents have been locally validated with mkdocs

@danny-avila danny-avila changed the title Disabled paste prevention in confirm password field when resetting passwords 📋 refactor: allow paste in confirm field when resetting passwords Apr 26, 2024
@danny-avila
Copy link
Owner

thanks! lgtm

@danny-avila danny-avila merged commit 4d0806d into danny-avila:main Apr 26, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants