-
-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Refactor pwnedPassword.js to use hash range API #22
Comments
Hey @danieladams456, thanks for bringing this up! When I saw the new search-by-range feature, I rushed to create I do wonder if |
One thing I appreciated about your library (I'm new-ish to JS) was how well organized it was for the tree shaking and test coverage. I agree that using the more generic case of returning an integer would be less limiting for the consumer since it more closely mirrors the upstream API. If you're good with a major version release that sounds like a plan to me. The nice thing is you could still do an if statement off of the truthiness of the integer returned and get the same behavior. Since |
Thanks for noticing, I've tried to put enough emphasis on those things. 😅
Yeah, exactly. It probably won't even be breaking for most people (doing loose truthy/falsey checks) but technically it will be, so we'll bump major.
Let's drop it. Consumers will lose the ability to submit a hash using |
Depending on my availability over the next bit, I would be interested in trying to implement this feature.
Currently the pwnedPassword check uses the v1 api, but it would be nice to use the more secure v2 hash range api. This module could depend upon
pwnedPasswordRange.js
and provide the higher level API without needing to search through the results.I was envisioning using this as a type of password strength tester for user signup beyond the basic length/character set, so there could be a case where you were ok with 5 pwns but not 5,000. I would add a
maxPwns: number
parameter to the options object (convenient it's already there!) to facilitate that behavior. DefaultmaxPwns
would be 1, and the method would return a boolean as it does currently.The text was updated successfully, but these errors were encountered: