8000 fix: improve password validation flow by defelmnq · Pull Request #15132 · coder/coder · GitHub
[go: up one dir, main page]
Skip to content

fix: improve password validation flow #15132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 21 commits into from
Nov 5, 2024
Merged

fix: improve password validation flow #15132

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
b93dc6b
fix(setup): improve password validation flow on first user setup
defelmnq Oct 18, 2024
cf31dde
fix(setup): improve password validation flow on first user setup
defelmnq Oct 18, 2024
309d839
feat(password): WIP
defelmnq Oct 22, 2024
388a58b
feat(password): apply backend logic to all password set fields
defelmnq Oct 22, 2024
f9cce4c
Merge remote-tracking branch 'origin/main' into fix-password-validation
defelmnq Oct 23, 2024
8a5e63f
Merge remote-tracking branch 'origin/main' into fix-password-validation
defelmnq Oct 23, 2024
8f695ab
feat(password): apply backend logic to all password set fields
defelmnq Oct 23, 2024
c103559
feat(password): apply backend logic to all password set fields
defelmnq Oct 23, 2024
dc46019
feat(password): apply backend logic to all password set fields
defelmnq Oct 23, 2024
37072ee
feat(password): apply backend logic to all password set fields
defelmnq Oct 23, 2024
b4b8b06
feat(password): apply backend logic to all password set fields
defelmnq Oct 23, 2024
0efd24f
feat(password): add test for validate password method
defelmnq Oct 23, 2024
a6ee1cc
fix(password): display only if password is set
defelmnq Oct 24, 2024
51b1e51
WIP: Working on testing improvement
defelmnq Oct 24, 2024
e2128e6
site: change logic to generate error instead of helper text on passwo…
defelmnq Oct 24, 2024
f37ef9e
fix storybook
defelmnq Oct 24, 2024
36cadeb
Merge remote-tracking branch 'origin/main' into fix-password-validation
defelmnq Oct 25, 2024
175b4bf
feat(password): add details field to validate password endpoint
defelmnq Oct 28, 2024
f33eac2
feat(password): add details field to validate password endpoint
defelmnq Oct 28, 2024
2e0941b
Extract validation logic to a component
BrunoQuaresma Nov 4, 2024
3869dd5
Merge remote-tracking branch 'origin/main' into fix-password-validation
defelmnq Nov 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions coderd/userpassword/userpassword.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ import (
"strconv"
"strings"

passwordvalidator "github.com/wagslane/go-password-validator"
"golang.org/x/crypto/pbkdf2"
"golang.org/x/exp/slices"
"golang.org/x/xerrors"
Expand Down Expand Up @@ -138,10 +137,8 @@ func hashWithSaltAndIter(password string, salt []byte, iter int) string {
// It returns properly formatted errors for detailed form validation on the client.
func Validate(password string) error {
// Ensure passwords are secure enough!
// See: https://github.com/wagslane/go-password-validator#what-entropy-value-should-i-use
err := passwordvalidator.Validate(password, 52)
if err != nil {
return err
if len(password) < 6 {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now this logic stays pretty simple - here's the place where we'll be able to apply all the validation logic we want

Copy link
Member
@johnstcn johnstcn Oct 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I'm concerned here, we are squishing together three distinct separate changes:

  1. Expose a password complexity validation endpoint on the backend
  2. Modify the password validation logic on the FE to query the BE
  3. Modify the password validation logic on the BE

Of these three options, 1) and 2) are relatively innocuous. 3) is the one I'm mainly concerned about.

I propose keeping the existing password validation logic (via entropy) in this PR and opening a separate PR to modify the password validation logic if required.

My proposal for a roughly equivalent non-entropy-based password validation logic is:

  1. At least one non-alphanumeric non-whitespace character ([^a-zA-Z0-9\s])
  2. Minimum length of 9 runes

EDIT: we should however be extremely careful if we change the validation, as users could have existing passwords that are valid per entropy but invalid per the above rule.

return xerrors.Errorf("password must be at least %d characters", 6)
}
if len(password) > 64 {
return xerrors.Errorf("password must be no more than %d characters", 64)
Expand Down
27 changes: 27 additions & 0 deletions coderd/userpassword/userpassword_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
package userpassword_test

import (
"strings"
"testing"

"github.com/stretchr/testify/require"
Expand All @@ -14,6 +15,32 @@ import (

func TestUserPassword(t *testing.T) {
t.Parallel()

t.Run("Invalid - Too short password", func(t *testing.T) {
t.Parallel()
err := userpassword.Validate("pass")
require.Error(t, err)
})

t.Run("Invalid - Too long password", func(t *testing.T) {
t.Parallel()

var sb strings.Builder
for i := 0; i < 65; i++ {
sb.WriteString("a")
}

err := userpassword.Validate(sb.String())
require.Error(t, err)
})

t.Run("Ok", func(t *testing.T) {
t.Parallel()

err := userpassword.Validate("CorrectPassword")
require.NoError(t, err)
})

t.Run("Legacy", func(t *testing.T) {
t.Parallel()
// Ensures legacy v1 passwords function for v2.
Expand Down
7 changes: 6 additions & 1 deletion site/src/pages/SetupPage/SetupPageView.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ export const Language = {
usernameLabel: "Username",
emailInvalid: "Please enter a valid email address.",
emailRequired: "Please enter an email address.",
passwordTooShort: "Password should be at least 6 characters.",
passwordTooLong: "Password should be no more than 64 characters.",
passwordRequired: "Please enter a password.",
create: "Create account",
welcomeMessage: <>Welcome to Coder</>,
Expand All @@ -54,7 +56,10 @@ const validationSchema = Yup.object({
.trim()
.email(Language.emailInvalid)
.required(Language.emailRequired),
password: Yup.string().required(Language.passwordRequired),
password: Yup.string()
.min(6, Language.passwordTooShort)
.max(64, Language.passwordTooLong)
.required(Language.passwordRequired),
username: nameValidator(Language.usernameLabel),
trial: Yup.bool(),
trial_info: Yup.object().when("trial", {
Expand Down
Loading
0