search

yann-yinn / adonis-starter

A Node.js / TypeScript / Postgres starter with ready-to-use users management (register, login, forgot password etc) to focus on building your new ideas. Built upon the excellent AdonisJS MVC Framework.
71 stars 15 forks source link

Security - Signup Form - email and password must be distinct values #13

Open yann-yinn opened 3 years ago

yann-yinn commented 3 years ago

Today it is possible to create an account where id and password are the same value. This should not be possible.

See CreateUserValidator and AdminCreateUserValidator for form validation.

Yoann-TYT commented 3 years ago

@yann-yinn After this commit https://github.com/yann-yinn/adonis-starter/commit/efb697e086a7c46ceb4ef23f4029abb7e0b683dc I think it isn't useful anymore. What do you think about ?

yann-yinn commented 3 years ago

@Yoann-TYT Hello 👋 This commit is a refacto commit so i'm note sure how this related ?

Yoann-TYT commented 3 years ago

@yann-yinn That's true :D https://github.com/yann-yinn/adonis-starter/blob/5ef15a51b76ac3af5371b1439a5b6c4932b54534/app/Validators/UserValidators.ts#L13 Password rules are now very restrictive, so it isn't possible anymore to have an email as password ;)

yann-yinn commented 3 years ago

Oh yes. Actually you can still copy paste your email and just add what is required by rules, like so.

example@example.comA1!

But maybe it's good enough for now

Yoann-TYT commented 3 years ago

Indeed, the password can contain the email :) I didn't think about that

yann-yinn commented 3 years ago

Yep, and even with this rules, P@ssword123 is considered strong, so rules are pretty annoying for user without preventing some very bad passwords, but that's okay for now. I'm thinking about how to improve this for the next iteration, if people actually use this project.

edit: for the record I got interesting answers about this topic here: https://twitter.com/yann_yinn/status/1444259738523406337

Yoann-TYT commented 3 years ago

Yep, this is always the same problem :-/ A security awareness problem Maybe an ads to use BitWarden or LastPass ? :D ( It's a joke ! )