Skip to content

chore: migrate from strength to zxcvbn for password validation #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 5, 2020
Merged

chore: migrate from strength to zxcvbn for password validation #380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions template/config/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ const consolidate = require('consolidate');
const manifestRev = require('manifest-rev');
const ms = require('ms');
const nodemailer = require('nodemailer');
const strength = require('strength');
const zxcvbn = require('zxcvbn');
const { boolean } = require('boolean');

const pkg = require('../package');
Expand Down Expand Up @@ -171,9 +171,9 @@ const config = {
keylen: 512,
passwordValidator: (password, fn) => {
if (env.NODE_ENV === 'development') return fn();
const howStrong = strength(password);
const { score } = zxcvbn(password);
fn(
howStrong < 3
score < 3
? Boom.badRequest(phrases.INVALID_PASSWORD_STRENGTH)
: null
);
Expand Down
4 changes: 2 additions & 2 deletions template/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,11 +112,11 @@
"signale": "^1.4.0",
"speakingurl": "^14.0.1",
"stacktrace-js": "^2.0.2",
"strength": "^0.1.4",
"sweetalert2": "8.x",
"titleize": "^2.1.0",
"uncaught": "^0.0.5",
"validator": "^13.0.0"
"validator": "^13.0.0",
"zxcvbn": "^4.4.2"
},
"devDependencies": {
"@babel/cli": "^7.8.4",
Expand Down
23 changes: 23 additions & 0 deletions template/test/web/auth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
const util = require('util');
const test = require('ava');
const cryptoRandomString = require('crypto-random-string');

const phrases = require('../../config/phrases');
const { Users } = require('../../app/models');
Expand Down Expand Up @@ -27,6 +28,28 @@ test('fails registering with easy password', async t => {
t.is(res.status, 400);
});

test('successfully registers with strong password', async t => {
const res = await global.web.post('/en/register', {
body: {
email: 'test12@example.com',
password: 'Thi$i$@$r0ng3rP@$$W0rdMyDude'
}
});
t.is(res.body.message, undefined);
t.is(res.status, 200);
});

test('successfully registers with stronger password', async t => {
const res = await global.web.post('/en/register', {
body: {
email: 'test123@example.com',
password: cryptoRandomString({ length: 50 })
}
});
t.is(res.body.message, undefined);
t.is(res.status, 200);
});

test('fails registering invalid email', async t => {
const res = await global.web.post('/en/register', {
body: {
Expand Down
10 changes: 5 additions & 5 deletions template/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17180,11 +17180,6 @@ streaming-json-stringify@3:
json-stringify-safe "5"
readable-stream "2"

strength@^0.1.4:
version "0.1.4"
resolved "https://registry.yarnpkg.com/strength/-/strength-0.1.4.tgz#c12b1a254fe50150eab6e21a80ebac6426ec561b"
integrity sha1-wSsaJU/lAVDqtuIagOusZCbsVhs=

strict-uri-encode@^1.0.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/strict-uri-encode/-/strict-uri-encode-1.1.0.tgz#279b225df1d582b1f54e65addd4352e18faa0713"
Expand Down Expand Up @@ -19737,3 +19732,8 @@ ylru@^1.2.0:
version "1.2.1"
resolved "https://registry.yarnpkg.com/ylru/-/ylru-1.2.1.tgz#f576b63341547989c1de7ba288760923b27fe84f"
integrity sha512-faQrqNMzcPCHGVC2aaOINk13K+aaBDUPjGWl0teOXywElLjyVAB6Oe2jj62jHYtwsU49jXhScYbvPENK+6zAvQ==

zxcvbn@^4.4.2:
version "4.4.2"
resolved "https://registry.yarnpkg.com/zxcvbn/-/zxcvbn-4.4.2.tgz#28ec17cf09743edcab056ddd8b1b06262cc73c30"
integrity sha1-KOwXzwl0PtyrBW3dixsGJizHPDA=