Require a minimum of 14 characters for strong passwords - #38084
Require a minimum of 14 characters for strong passwords#38084dannyroberts wants to merge 3 commits into
Conversation
dimagimon
added
the
Risk: High
dannyroberts
added
the
product/all-users-all-environments
Previously 12 in Python, 10-14 in JS. These generators pre-fill fields that are then validated against settings.MINIMUM_PASSWORD_LENGTH, so anything shorter suggests a password that fails on submit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Line-number shifts only, from ./manage.py build_bootstrap5_diffs. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
606031d to
cef23e5
Compare
nospame
left a comment
nospame
left a comment
There was a problem hiding this comment.
Couple of comments below on how we define these similar but maybe not quite identical constants.
Also, a nitpick, it's nice to let the build_bootstrap5_diffs command do its own commit which clearly labels "Bootstrap 5 Migration - Rebuilt diffs".
| # Must not be shorter than settings.MINIMUM_PASSWORD_LENGTH, or generated | ||
| # passwords will be rejected by clean_password(). Kept in sync with | ||
| # STRONG_PASSWORD_LEN in users/js/bootstrap{3,5}/mobile_workers.js. | ||
| STRONG_PASSWORD_LEN = 14 |
There was a problem hiding this comment.
Could this just be STRONG_PASSWORD_LEN = settings.MINIMUM_PASSWORD_LENGTH, and probably skip the comment?
| // Must not be shorter than settings.MINIMUM_PASSWORD_LENGTH, or generated | ||
| // passwords will be rejected by the server. Kept in sync with | ||
| // STRONG_PASSWORD_LEN in corehq/apps/users/forms.py. | ||
| var STRONG_PASSWORD_LEN = 14; |
There was a problem hiding this comment.
Is there a way to pass this in from that constant in forms.py so we're not setting the same thing in two places?
Alternately, we might use initialPageData.get('minimumPasswordLength') (the same as settings.MINIMUM_PASSWORD_LENGTH if the goal is actually to set this the same as the minimum password length setting.
3 participants
Product Description
Minimum password length goes from 8 to 14 wherever HQ enforces password strength. This is in line with our changing internal standard for password strength.
Technical Summary
MINIMUM_PASSWORD_LENGTH8 → 14. The suggested-password generators (12 chars in Python, 10–14 in JS) pre-fill fields validated against that setting, so they're updated accordingly as well.Safety Assurance
Safety story
Runs only when a password is set; no force reset. Bulk upload allows leaving existing passwords be. Existing bulk upload sheets may not be able to be re-uploaded, but the more common download-edit-upload cycle will work without issue.
Automated test coverage
New tests tie the generators to the setting.
Rollback instructions
Labels & Review