search

brendanashworth / generate-password

NodeJS library for generating cryptographically-secure passwords.
MIT License
354 stars 67 forks source link

Is it guaranteed that there will be at least one lowercase character when strict mode is true? #30

Closed collin-pham closed 4 years ago

collin-pham commented 4 years ago

Is it guaranteed that there will be at least one lowercase character when multiple options, including strict, are set to true. For example, if my options object looks like

const options = {
    length: 4,
    numbers: true,
    symbols: true,
    uppercase: true,
    strict: true,
}

Is it possible that generator.generate(options) will return a string without any lowercase characters. That is, it will only contain numbers, symbols and uppercase characters.

It would be helpful to add the answer to this question to the README. Thanks!

donedgardo commented 4 years ago

I was thinking the same thing. One of our user generators failed for missing requirments, it may be because of this.

brendanashworth commented 4 years ago

I don't believe this is guaranteed, no. There's a test for something similar, but that passes out of lacking other characters, not for fulfilling a strict lowercase requirement.

There is a lowercase rule, which when combined with strict mode should guarantee the presence of a lowercase character.

That option, though, is neither documented nor unit tested, so that should be fixed.

@donedgardo @collin-pham you should be able to combine lowercase: true with strict: true to get this guarantee for the time being. If you want to send a PR with an improvement, I'll review it, otherwise I'll patch this over the weekend.

donedgardo commented 4 years ago

31 @brendanashworth

brendanashworth commented 4 years ago

31 has been merged and released into 1.5.0 so this should be fixed! https://github.com/brendanashworth/generate-password/commit/1862283ee922b359f6f8636909ee0b41e6fd3ce4