add isStrongPassword method #1348

tbeeck · 2020-06-07T20:31:22Z

For issue #1145
This adds the isStrongPassword method. It does include tests for when returning true/false, but not for when returning the score due to issues with test design decried here: #1145 (comment)

I am open to suggestions on how the passwords are scored since this algorithm is pretty rudimentary.

This is my first contribution to a public project, please let me know if there is anything else I can change to make this better :)

Checklist

PR contains only changes related; no stray files, etc.
README updated (where applicable)
Tests written (where applicable)

profnandaa · 2020-06-08T17:21:22Z

@rubiin @tux-tn -- can review this one here please?

tux-tn

It looks good to me. Great job @door-bell 🎉
I have two comments:

I think Readme is missing default values for strongThreshold and score
Since there is no standard defined for a strong password. I think the validator is a little biased. Generally validators are based on norms, standards or definitions but here this is not the case. I'm not saying that this validator is a bad thing but I think we should rather let the user choose his own definition rather than create a custom scoring system

tbeeck · 2020-06-11T18:30:41Z

@tux-tn Yeah, I agree that the validator is biased and won't necessarily meet the user's expectations every time. I implemented the scoring system since it was suggested in the feature request #1145 .

Do you think it would be helpful to allow the user to pass in a list of requirements like this as an optional usage?

let requirements = {
     minCharCount = 8,
     mustContainUpper = true,
     mustContainNumber = true,
     mustContainSymbol = true
}

I will hold off on fixing readme just in case we want to change things further, but I'll be sure to update that as well.

rubiin · 2020-06-11T18:38:15Z

@tux-tn Yeah, I agree that the validator is biased and won't necessarily meet the user's expectations every time. I implemented the scoring system since it was suggested in the feature request #1145 .

Do you think it would be helpful to allow the user to pass in a list of requirements like this as an optional usage?
let requirements = {
     minCharCount = 8,
     mustContainUpper = true,
     mustContainNumber = true,
     mustContainSymbol = true
}
I will hold off on fixing readme just in case we want to change things further, but I'll be sure to update that as well.

passing options looks good plus it gives user some customizability on the parameters values

tbeeck · 2020-06-11T20:25:03Z

Now the user can decide to check the password by score or by requirements with these defaults specified:

const defaultRequirementOptions = {
  minLength: 8,
  minLowercase: 1,
  minUppercase: 1,
  minNumbers: 1,
  minSymbols: 1,
};

const defaultScoringOptions = {
  returnScore: false,
  pointsPerUnique: 1,
  pointsPerRepeat: 0.5,
  pointsForContainingLower: 10,
  pointsForContainingUpper: 10,
  pointsForContainingNumber: 10,
  pointsForContainingSymbol: 10,
  minStrongScore: 50,
};

isStrongPassword defaults to checking based on requirements. To use the scoring system, the user needs to use the named parameter scoringOptions.
Not sure if this is an optimal design, I am open to other suggestions.

…nto strong-password

tbeeck · 2020-06-29T04:30:11Z

After some more consideration I decided to change how the options work. Now there is a single options parameter with these defaults:

const defaultOptions = {
  minLength: 8,
  minLowercase: 1,
  minUppercase: 1,
  minNumbers: 1,
  minSymbols: 1,
  returnScore: false,
  pointsPerUnique: 1,
  pointsPerRepeat: 0.5,
  pointsForContainingLower: 10,
  pointsForContainingUpper: 10,
  pointsForContainingNumber: 10,
  pointsForContainingSymbol: 10,
};

The user simply decides if they want a score or not using returnScore. Otherwise it defaults to returning a boolean based on the minimum requirements for the password. This seems like a more intuitive usage to me, and the user can still test the password against a minimum score on their own. (Also, sorry this PR got messy with commits, I had some trouble syncing my remote branches across two machines)

profnandaa · 2020-11-15T23:32:35Z

@door-bell -- I'm sorry for my delayed response on this; this sounds good to me. Are you available for any further review comments this week so that we land this with the November release?

/cc. @tux-tn @ezkemboi

profnandaa

This LGTM for the most part. I like the flexibility in scoring!

tbeeck · 2020-11-15T23:57:02Z

@profnandaa Yep I'm available for any more comments!

profnandaa · 2020-11-17T03:57:45Z

@tux-tn @rubiin @ezkemboi -- please have a look.

ezkemboi · 2020-11-17T04:15:49Z

Looks good here @profnandaa but I need to confirm something on percentage scoring.
A minute I test out locally.

ezkemboi

Generally good work.

ezkemboi · 2020-11-17T04:21:46Z

test/validators.js

+        'EXAMPLE of very long_password123!',
+        'mxH_+2vs&54_+H3P',
+        '+&DxJ=X7-4L8jRCD',
+        'etV*p%Nr6w&H%FeF',


There is a need for tests that pass returnScore as an option

Added the tests for this case in the sanitizers.js test file since with this option, the function essentially becomes a sanitizer, turning the string into a number. Hope that makes sense

ezkemboi · 2020-11-17T04:31:53Z

README.md

@@ -150,6 +150,7 @@ Validator                               | Description
 **isSurrogatePair(str)**                | check if the string contains any surrogate pairs chars.
 **isUppercase(str)**                    | check if the string is uppercase.
 **isSlug**                              | Check if the string is of type slug. `Options` allow a single hyphen between string. e.g. [`cn-cn`, `cn-c-c`]
+**isStrongPassword(str, requirementOptions?, scoringOptions?)**   | Check if a password is strong or not. Allows for custom requirements or scoring rules. If `returnScore` is true, then the function returns an integer score for the password rather than a boolean.<br/>Default options: <br/>`{ minLength: 8, minLowercase: 1, minUppercase: 1, minNumbers: 1, minSymbols: 1, returnScore: false, pointsPerUnique: 1, pointsPerRepeat: 0.5, pointsForContainingLower: 10, pointsForContainingUpper: 10, pointsForContainingNumber: 10, pointsForContainingSymbol: 10 }`


From my look of the eye, I thought, I needed to pass 3 parameters, though 2 are optional.
But, from function arguments call, it takes str & option.
I expected something like below...

isStrongPassword(str [, options])

It is not a priority but my suggestion for consistency and easy readability/usage.

Missed this, thanks!

profnandaa · 2020-11-17T22:11:11Z

@door-bell -- you can address Ez's comments and we land this soonest. We would like to make a release this Friday.

tbeeck · 2020-11-17T23:37:21Z

Travis job stuck in the queue D: However I pushed some changes to address those comments and this should be good to go

codecov · 2020-11-18T00:35:31Z

Codecov Report

❗ No coverage uploaded for pull request base (master@a3cddc1). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master    #1348   +/-   ##
=========================================
  Coverage          ?   99.92%           
=========================================
  Files             ?       97           
  Lines             ?     1332           
  Branches          ?        0           
=========================================
  Hits              ?     1331           
  Misses            ?        1           
  Partials          ?        0

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a3cddc1...8ab1d36. Read the comment docs.

profnandaa

LGTM, once again, thanks for your contrib! 🎉

rubiin · 2020-11-19T09:53:00Z

@profnandaa when will the next release be available

profnandaa · 2020-11-23T02:36:43Z

Hopefully today buddy.

On Thu, Nov 19, 2020 at 12:53 PM Rubin Bhandari ***@***.***> wrote: @profnandaa <https://github.com/profnandaa> when will the next release be available — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1348 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAB7ZELVKXCHE5HKFKNS34LSQTTIVANCNFSM4NXTY4AQ> .

-- Sent from a tiny device while on the move.

tbeeck added 4 commits June 7, 2020 13:16

Add isStrongPassword method

b830f3a

Add tests

f815e4b

update README.md with isStrongPassword

5a112a0

remove console.log

78ae116

profnandaa added needs-more-review 🕑 to-be-reviewed labels Jun 8, 2020

tux-tn reviewed Jun 11, 2020

View reviewed changes

Merge remote-tracking branch 'upstream/master' into strong-password

f9330e6

tbeeck added 6 commits June 11, 2020 12:35

add tests

7100af8

allow either scoring or minimum requirements

2efe12b

rename threshold to be more descriptive

aed4a22

update isStrongPassword doc

21f0b26

shorten function declaration

a55d712

fix confusing parameters

97205aa

profnandaa mentioned this pull request Jun 13, 2020

Validate strong Password by validate_password.js #1148

Closed

tbeeck added 8 commits June 15, 2020 18:46

Merge branch 'master' into strong-password

16e98a2

Merge branch 'master' into strong-password

d78eae1

Merge branch 'master' into strong-password

9f9e68e

Merge branch 'strong-password' of github.com:door-bell/validator.js i…

a5971b1

…nto strong-password

combine separate options for more simple usage

1669bfa

remove obsolete tests

d1aedcc

remove minstrongscore option

23ebf82

update README

883f544

profnandaa approved these changes Nov 15, 2020

View reviewed changes

profnandaa removed the 🕑 to-be-reviewed label Nov 15, 2020

profnandaa added the ✅ LGTM label Nov 17, 2020

ezkemboi requested changes Nov 17, 2020

View reviewed changes

tbeeck added 4 commits November 17, 2020 14:47

update isStrongPassword signature

a85ea30

Add default args for clarity

19baf6d

Add tests for isStrongPassword scoring

9e36980

Fix typo

8ab1d36

ezkemboi approved these changes Nov 18, 2020

View reviewed changes

profnandaa approved these changes Nov 19, 2020

View reviewed changes

profnandaa merged commit 27aa419 into validatorjs:master Nov 19, 2020

profnandaa mentioned this pull request Nov 29, 2020

release staging: Nov 2020 release notes #1535

Merged

This was referenced Mar 12, 2021

chore(deps): bump validator from 9.4.1 to 13.5.2 in /api-server Dman247/freeCodeCamp#185

Open

Bump validator from 13.1.17 to 13.5.2 razee-io/Razeedash-api#825

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add isStrongPassword method #1348

add isStrongPassword method #1348

tbeeck commented Jun 7, 2020 •

edited

Loading

profnandaa commented Jun 8, 2020

tux-tn left a comment

tbeeck commented Jun 11, 2020

rubiin commented Jun 11, 2020

tbeeck commented Jun 11, 2020

tbeeck commented Jun 29, 2020

profnandaa commented Nov 15, 2020

profnandaa left a comment

tbeeck commented Nov 15, 2020

profnandaa commented Nov 17, 2020

ezkemboi commented Nov 17, 2020 •

edited

Loading

ezkemboi left a comment

ezkemboi Nov 17, 2020

tbeeck Nov 17, 2020

ezkemboi Nov 17, 2020

tbeeck Nov 17, 2020

profnandaa commented Nov 17, 2020

tbeeck commented Nov 17, 2020

codecov bot commented Nov 18, 2020 •

edited

Loading

profnandaa left a comment

rubiin commented Nov 19, 2020

profnandaa commented Nov 23, 2020 via email

add isStrongPassword method #1348

add isStrongPassword method #1348

Conversation

tbeeck commented Jun 7, 2020 • edited Loading

Checklist

profnandaa commented Jun 8, 2020

tux-tn left a comment

Choose a reason for hiding this comment

tbeeck commented Jun 11, 2020

rubiin commented Jun 11, 2020

tbeeck commented Jun 11, 2020

tbeeck commented Jun 29, 2020

profnandaa commented Nov 15, 2020

profnandaa left a comment

Choose a reason for hiding this comment

tbeeck commented Nov 15, 2020

profnandaa commented Nov 17, 2020

ezkemboi commented Nov 17, 2020 • edited Loading

ezkemboi left a comment

Choose a reason for hiding this comment

ezkemboi Nov 17, 2020

Choose a reason for hiding this comment

tbeeck Nov 17, 2020

Choose a reason for hiding this comment

ezkemboi Nov 17, 2020

Choose a reason for hiding this comment

tbeeck Nov 17, 2020

Choose a reason for hiding this comment

profnandaa commented Nov 17, 2020

tbeeck commented Nov 17, 2020

codecov bot commented Nov 18, 2020 • edited Loading

Codecov Report

profnandaa left a comment

Choose a reason for hiding this comment

rubiin commented Nov 19, 2020

profnandaa commented Nov 23, 2020 via email

tbeeck commented Jun 7, 2020 •

edited

Loading

ezkemboi commented Nov 17, 2020 •

edited

Loading

codecov bot commented Nov 18, 2020 •

edited

Loading