search

langleyfoxall / laravel-boilerplate

Boilerplate for Laravel with common tools/plugins for ease of development.
MIT License
2 stars 4 forks source link

Add password security package #12

Closed jaredkove closed 5 years ago

jaredkove commented 5 years ago

Enterprise software should always have security at its heart.

We've (@DivineOmega) recently developed a Laravel Package that ensures we follow NIST's password standards by default - it would be good to get this incorporated into the boilerplate and have it on the register/reset password screens.

As an overview:

Recommendation Implementation
[...] at least 8 characters in length A standard validation rule in all rule sets to validate against this minimum length of 8 characters.
Passwords obtained from previous breach corpuses The BreachedPasswords rule securely checks the password against previous 3rd party data breaches, using the Have I Been Pwned - Pwned Passwords API.
Dictionary words The DictionaryWords rule checks the password against a list of over 102k dictionary words.
Context-specific words, such as the name of the service, the username The ContextSpecificWords rule checks the password does not contain the provided username, and any words defined the configured app name or app URL.
Context-specific words, [...] and derivatives thereof The DerivativesOfContextSpecificWords rule checks the password is not too similar to the provided username, and any words defined the configured app name or app URL.
DivineOmega commented 5 years ago

For whomever implements this, it will mostly involve changes to the controllers present in app/Http/Controllers/Auth/.

Specifically you will need to override methods provide by some of the traits those controllers use.

I've already implemented this in a private repo, ask me for the link to the commit if needed.