[Validator] Make API endpoint for NotCompromisedPasswordValidator configurable

[xelan]

Description
The new NotCompromisedPasswordValidator is a very nice feature which greatly improves the security of user accounts.

Having a look at the source file for pwnedpasswords.com (pwned-passwords-sha1-ordered-by-count-v4.txt), providing the same basic API for range check endpoints is quite trivial.

Making the API endpoint configurable instead of a hardcoded constant (NotCompromisedPasswordValidator::RANGE_API) would allow to use the password compromise check in intranets without requiring internet access for the validation. Only the range API server would need to periodically refresh its data source.

In addition, integration testing and easier development using a minimal API server just providing a few known hashes would be possible, see #30871.

If you also think the feature might be useful, I can provide a PR.

Example

// src/Entity/User.php
namespace App\Entity;

use Symfony\Component\Validator\Constraints as Assert;

class User
{
    // ...

    /**
     * @Assert\NotCompromisedPassword (
     *     rangeApi = "https://password-check.internal.example.com"
     * )
     */
    protected $rawPassword;
}

[stof]

I don't think it should be part of the annotation. This looks better as a constructor argument of the validator, defined in the project config.

[xelan]

Ah, yes you're right, thanks. So similar to the validation.disable_not_compromised_password config value, and therefore the configuration is part of the FrameworkBundle?

[stof]

yes

[stof]

btw, if we add that, we should rework the validation to look like

framework:
    validation:
        not_compromised_password:
            enable: true
            endpoint: 'https://password-check.internal.example.com'

That way, settings of the not_compromised_password validator are grouped together. As disable_not_compromised_password is only available in master and not in a release, we can still rename it without having to do a BC layer, if we do it now.

[xelan]

This proposal sounds great 👍

[nicolas-grekas]

PR welcome :)

[Simperfit]

@xelan Do you want to try to contribute this ?

[xelan]

Yes, I'm already working on it 😄