Update password requirements #112
Conversation
brendansudol
force-pushed
the
update-pw-rules
branch
from
65c4928 to
c2c4965
Compare
|
new screenshot: |
| it 'works with spaces' do | ||
| PASSWORD_W_SPACES = 'this has a few spaces'.freeze | ||
|
|
||
| prototype_user = create(:user) |
There was a problem hiding this comment.
It's not necessary to create 2 users for this test. You can remove the prototype user, and update the user below to not specify an email since one will be created for it automatically via the Factory.
|
Strongly agree with removal of the password composition requirements (removing requirement for special characters, digits, etc.). In its place, the draft guidance says that you should check prospective passwords against a dictionary of known commonly-used and/or compromised values (those collected from breaches) and tell the user to pick another one if there is a match. You might consider doing that here. I can contribute a set of 3.1 million >=8 character passwords if that will help :) |
brendansudol
force-pushed
the
update-pw-rules
branch
2 times, most recently
from
7f8f08e to
1ccbd68
Compare
**Why**: to use latest NIST guidance / best practices
|
LGTM |
Include namespace bug fix for all validations
Why: to use latest NIST guidance / best practices