Wt
3.2.3
|
A default implementation for password strength validation. More...
Public Types | |
enum | PasswordType { OneCharClass, TwoCharClass, PassPhrase, ThreeCharClass, FourCharClass } |
Enumeration for a password type. More... | |
Public Member Functions | |
PasswordStrengthValidator () | |
Default constructor. | |
void | setMinimumLength (PasswordType type, int length) |
Sets the minimum length for a password of a certain type. | |
int | minimumLength (PasswordType type) |
Returns the minimum length for a password of a certain type. | |
void | setMinimumPassPhraseWords (int words) |
Sets the minimum number of words for a pass phrase. | |
int | minimumPassPhraseWords () const |
Returns the minimum number of words for a pass phrase. | |
void | setMinimumMatchLength (int length) |
Sets the minimum length for a match against a known sequence or the login name / email address. | |
int | minimumMatchLength () const |
Returns the minimum length for a match against a known sequence. | |
virtual AbstractPasswordService::StrengthValidatorResult | evaluateStrength (const WString &password, const WString &loginName, const std::string &email) const |
Evaluates the strength of a password. | |
Static Public Attributes | |
static const int | Disabled = std::numeric_limits<int>::max() |
Sentinel value to disable a particular check. |
A default implementation for password strength validation.
This implementation uses http://www.openwall.com/passwdqc/, a password checker commonly used to validate user account passwords in Linux/BSD distributions.
The default settings are not as restrictive as those used originally by passwdqc (which could be frustratingly restrictive for a web application). You may want to make it change the settings to demand stronger passwords for sensitive applications.
Enumeration for a password type.
An entered password will be classified as one of these types, based on the different characters used.
The classification uses the concept of character classes, and defines five classes:
For determining the number of classes, capitializaiton of the first letter of a word, or appending a number, does not count as an extra class.
AbstractPasswordService::StrengthValidatorResult Wt::Auth::PasswordStrengthValidator::evaluateStrength | ( | const WString & | password, |
const WString & | loginName, | ||
const std::string & | |||
) | const [virtual] |
Evaluates the strength of a password.
The result is an instance of StrengthValidatorResult which contains information on the validity and the strength (0 if invalid, 5 if valid) of the password together with possible messages.
The validator takes into account the user's login name and email address, to exclude passwords that are too similar to these.
Implements Wt::Auth::AbstractPasswordService::AbstractStrengthValidator.
int Wt::Auth::PasswordStrengthValidator::minimumLength | ( | PasswordType | type | ) |
Returns the minimum length for a password of a certain type.
int Wt::Auth::PasswordStrengthValidator::minimumMatchLength | ( | ) | const |
Returns the minimum length for a match against a known sequence.
int Wt::Auth::PasswordStrengthValidator::minimumPassPhraseWords | ( | ) | const |
Returns the minimum number of words for a pass phrase.
void Wt::Auth::PasswordStrengthValidator::setMinimumLength | ( | PasswordType | type, |
int | length | ||
) |
Sets the minimum length for a password of a certain type.
See the PasswordType documentation for defaults. You may disable a password of a certain class entirely using the special value Disabled.
void Wt::Auth::PasswordStrengthValidator::setMinimumMatchLength | ( | int | length | ) |
Sets the minimum length for a match against a known sequence or the login name / email address.
Irrespective of other settings, a password may be checked not to contain common sequences.
This sets the minimum number of characters which is considered as a match of a password against a known sequence. A lower length
setting is thus more stringent.
The default value is 4.
void Wt::Auth::PasswordStrengthValidator::setMinimumPassPhraseWords | ( | int | words | ) |
Sets the minimum number of words for a pass phrase.
Sets the minimum number of words for a valid pass phrase.
The default value is 3.