mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-09-11 21:39:01 +00:00
xarmian
a86cfb7cff
* feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669)
Previously all three entrypoints (bootstrap, register, password change,
password reset) only enforced 8 <= len <= 128. Top-of-breach-list
entries like "password", "password123", "qwerty1234", and "letmein1"
all passed that filter and could silently end up hashed into a real
account.
- New validatePasswordStrength helper wraps github.com/trustelem/zxcvbn
with:
* length guardrails (8-128) kept as cheap early exits
* user-input context (email, name) passed into the scorer so
Alice+"Alice2026" gets penalized as email-derived
* minimum score 2 (OWASP-recommended floor, "adequate for online
attack scenarios")
* empty context strings filtered — zxcvbn treats "" as a banned
substring which would incorrectly weaken every password
- Wired into all four validation points in handlers_auth.go:
bootstrap, register, PATCH /auth/me (password change), reset-password.
- Test suite uses a strong canonical password now
("correct-horse-battery-staple") so bootstrapFirstUser + login flows
don't fight the new check.
- Password_strength_test.go covers: length extremes, the RockYou
top-100 (password, 123456, qwerty, iloveyou, letmein1, …),
email-derived + name-derived patterns, and three acceptable
passphrases.
Parent: PLAN-643 (OSS Security Hardening).
* fix(server): use pending name/username as strength-check context in PATCH /auth/me (TASK-669)
Addresses Codex P2 on PR #193: a PATCH that changed BOTH name and
password used the OLD user.Name as the zxcvbn user-input context, so
a caller could rename themselves to Zaphod + set password "zaphodzaphod"
in one request and slip the identity-derived penalty.
- When input.Name/input.Username are set in the PATCH, use those
pending values (not user.Name / user.Username) as the context for
validatePasswordStrength. Email stays as user.Email — email change
has its own flow and confirmation, not inline here.
- TestPasswordChange_RejectsPasswordDerivedFromPendingName pins the
fix with an integration-level regression test.
- TestValidatePasswordStrength_ContextPenalizesDerivedPasswords pins
the underlying unit behavior (context string actually tips the
score) so a future library swap can't silently regress.
Parent: PLAN-643 (OSS Security Hardening).
* fix(server): identity-aware reset strength check + username context on registration (TASK-669)
Addresses two Codex comments on PR #193:
P2 — reset handler ran a context-less strength check because
ConsumePasswordReset was atomic and gave us the user only after the
token was burned. That made /auth/reset-password enforce a weaker
policy than bootstrap/register/rotation and opened an identity-derived-
password bypass on the primary recovery endpoint.
- New Store.LookupPasswordReset is a read-only validation that returns
the user without consuming the token. handleResetPassword now does
two-phase: lookup → strength-check with full context (email, name,
username) → consume. On strength rejection the token is NOT burned
so the user can try again on the same reset link instead of having
to request another email.
P3 — registration strength check only passed email and name, not the
caller-supplied username. Identity-derived passwords keyed on the
username alone slipped past the zxcvbn user-input penalty.
- Added input.Username as the fourth context arg to
validatePasswordStrength in /auth/register.
Tests:
- TestPasswordReset_UsesIdentityContext: weak identity-derived password
rejected; same token then accepts a strong one (token preserved).
- TestRegister_IncludesUsernameInStrengthContext: username passed to
strength check penalizes username-derived passwords.
Parent: PLAN-643 (OSS Security Hardening).
60 lines
2.2 KiB
Go
60 lines
2.2 KiB
Go
package server
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/trustelem/zxcvbn"
|
|
)
|
|
|
|
// passwordStrengthMinScore is the minimum acceptable zxcvbn score
|
|
// (0-4) for new or rotated passwords. Scores map roughly to:
|
|
//
|
|
// 0 — too guessable (top-1k breach list) reject
|
|
// 1 — very guessable (common patterns, short) reject
|
|
// 2 — somewhat guessable (protection from online attacks) accept
|
|
// 3 — safely unguessable (protection from offline attacks) accept
|
|
// 4 — very unguessable (long unique password or passphrase) accept
|
|
//
|
|
// 2 is the OWASP-recommended floor for user-visible forms and what the
|
|
// zxcvbn paper itself names as "adequate for online attack scenarios".
|
|
const passwordStrengthMinScore = 2
|
|
|
|
// validatePasswordStrength enforces length + strength. It rejects weak
|
|
// passwords at registration / rotation / reset so top-of-breach-list
|
|
// entries like "password", "123456", and "qwerty" can't silently land
|
|
// in a fresh account.
|
|
//
|
|
// User-specific context (email, name) is fed into zxcvbn so the library
|
|
// can penalize passwords derived from the owner's own identity (common
|
|
// attack vector in credential-spraying).
|
|
//
|
|
// Returns nil if the password is acceptable. Otherwise returns an
|
|
// error whose Error() is safe to surface to the user — it contains no
|
|
// reflected input.
|
|
func validatePasswordStrength(password string, userInputs ...string) error {
|
|
// Keep the length guardrails; zxcvbn doesn't enforce an upper bound
|
|
// and a 1MB POST with a multi-megabyte password should fail fast
|
|
// before the scorer spends CPU on it.
|
|
if len(password) < 8 {
|
|
return fmt.Errorf("Password must be at least 8 characters")
|
|
}
|
|
if len(password) > 128 {
|
|
return fmt.Errorf("Password must be at most 128 characters")
|
|
}
|
|
|
|
// Filter out empty context strings — zxcvbn treats "" as a banned
|
|
// substring which incorrectly weakens every password.
|
|
var context []string
|
|
for _, s := range userInputs {
|
|
if s != "" {
|
|
context = append(context, s)
|
|
}
|
|
}
|
|
|
|
result := zxcvbn.PasswordStrength(password, context)
|
|
if result.Score < passwordStrengthMinScore {
|
|
return fmt.Errorf("Password is too weak — try a longer passphrase or add unusual characters")
|
|
}
|
|
return nil
|
|
}
|