[Validator] New `PasswordStrength` constraint #49789

Spomky · 2023-03-23T22:59:59Z

Q	A
Branch?	6.3
Bug fix?	no
New feature?	yes
Deprecations?	no
Tickets	none
License	MIT
Doc PR	symfony/symfony-docs#18124

This PR adds a new constraint PasswordStrength. This constraint is able to determine if the password strength (or any other string) fulfils with the minimum requirement.
It leverages on bjeavons/zxcvbn-php which is required when this constraint is used.

Example:

<?php

declare(strict_types=1);

namespace App\Form;

use Symfony\Component\Form\AbstractType;
use Symfony\Component\Form\Extension\Core\Type\PasswordType;
use Symfony\Component\Form\Extension\Core\Type\RepeatedType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\OptionsResolver\OptionsResolver;
use Symfony\Component\Validator\Constraints\NotBlank;
use Symfony\Component\Validator\Constraints\PasswordStrength;

final class ChangePasswordFormType extends AbstractType
{
    public function buildForm(FormBuilderInterface $builder, array $options): void
    {
        $restrictedData = $options['restrictedData'] ?? [];

        $builder
            ->add('plainPassword', RepeatedType::class, [
                'type' => PasswordType::class,
                'options' => [
                    'attr' => [
                        'autocomplete' => 'new-password',
                    ],
                ],
                'first_options' => [
                    'constraints' => [
                        new NotBlank(),
                        new PasswordStrength(['restrictedData' => $restrictedData])
                    ],
                    'label' => 'New password',
                ],
                'second_options' => [
                    'label' => 'Repeat the new password',
                ],
                'mapped' => false,
            ])
        ;
    }

    public function configureOptions(OptionsResolver $resolver): void
    {
        $resolver->setDefaults([
            'restrictedData' => [],
        ])
            ->setAllowedTypes('restrictedData', 'string[]')
        ;
    }
}

Then from e.g. a controller

$form = $this->createForm(ChangePasswordFormType::class, null, [
    'restrictedData' => [
        $user->getUsername(),
        $user->getEmail(),
        $user->getGivenName(),
        $user->getFamilyName(),
        'ApplicationName', // Arbitrary data
    ],
]);

It can be added as a property attribute:

<?php

declare(strict_types=1);

namespace App\Form;

use Symfony\Component\Validator\Constraints\NotBlank;
use Symfony\Component\Validator\Constraints\PasswordStrength;

final class ChangePasswordFormData
{
    #[NotBlank]
    #[PasswordStrength]
    public string $password = '';
}

Options:

lowStrengthMessage: the message in case of a weak password (default: The password strength is too low. Please use a stronger password.)
minScore: 0 means a weak password, 4 means a very good password (default: 2)
restrictedData: a list of restricted data e.g. user information such as ID, username, email, given name, last name or application information (default: [])
restrictedDataMessage: the message in case of the restricted data in the password (default: The password contains at least one restricted data: {{ wordList }}.)

lyrixx · 2023-03-23T23:04:51Z

We have something really similar in our application, so I think it's a good idea to have this feature in the core

94noni

would definitely use it :)

composer.json

94noni · 2023-03-24T08:26:47Z

src/Symfony/Component/Validator/Tests/Constraints/PasswordStrengthValidatorTest.php

+        ];
+        yield [
+            new PasswordStrength([
+                'restrictedData' => ['symfony'],


this is very nice
may I ask you to "complete" your PR desc with your usage of dump($userData); with the constraint?
or injecting for example the security user to define the username/email in the list, this would be very valuable

The dump statement is a wrong copy/paste.
I will add an example when the form factory is used with user/application data.

that will be wonderful for showcasing real usage in the doc repo after :)

OskarStark · 2023-03-24T18:04:49Z

I like the proposal 😃💪🏻

src/Symfony/Component/Validator/Constraints/PasswordStrength.php

fabpot

Love it as well (it has been on my todo list for a long time now, thank you for working on it).

andreybolonin · 2023-03-26T08:15:04Z

We have something really similar in our application, so I think it's a good idea to have this feature in the core

+1

fabpot

Can you add an entry in the component CHANGELOG file?

Spomky · 2023-03-26T12:51:07Z

Can you add an entry in the component CHANGELOG file?

Yes. Done.

fabpot · 2023-03-26T15:00:27Z

composer.json

@@ -152,7 +152,8 @@
        "symfony/security-acl": "~2.8|~3.0",
        "twig/cssinliner-extra": "^2.12|^3",
        "twig/inky-extra": "^2.12|^3",
-        "twig/markdown-extra": "^2.12|^3"
+        "twig/markdown-extra": "^2.12|^3",
+        "bjeavons/zxcvbn-php": "^1.0"


Should be added in the validator component composer.json as well.

Yes indeed I missed it. I have just added it as a dev dependency and in the suggest section as well.

chalasr

#37093 that's a long standing feature 👍
The docs should probably point to the OWASP recommandations to reduce misuses.

fabpot · 2023-03-26T16:00:51Z

src/Symfony/Component/Validator/composer.json

@@ -62,6 +63,7 @@
        "symfony/yaml": "",
        "symfony/config": "",
        "egulias/email-validator": "Strict (RFC compliant) email validation",
+        "bjeavons/zxcvbn-php": "Password strength estimation used by the PasswordStrength constraint",


Let's remove this one. It's not needed, and discovery happens with docs and/or auto-completion, ... but never via the suggest Composer thingy IMHO.

OK I understand. I removed this line.

fabpot · 2023-03-26T16:05:56Z

Thank you @Spomky.

Spomky · 2023-03-26T16:08:32Z

Thank you @Spomky.

You are welcome. I am really happy to contribute.

#37093 that's a long standing feature 👍 The docs should probably point to the OWASP recommandations to reduce misuses.

OK I will mention it in the documentation PR with some examples.

nicolas-grekas · 2023-03-27T14:21:08Z

Considered for reversion in #49831

…omky) This PR was merged into the 6.3 branch. Discussion ---------- [Validator] Document `PasswordStrength` constraint These modifications are proposed as per ~symfony/symfony#49789 => symfony/symfony#49856 Commits ------- ec51dd2 PasswordStrength Documentation pages

carsonbot added Status: Needs Review Feature labels Mar 23, 2023

carsonbot added this to the 6.3 milestone Mar 23, 2023

Spomky force-pushed the features/validator-password-strength branch from 1fd5fa3 to c6500cb Compare March 23, 2023 23:05

94noni reviewed Mar 24, 2023

View reviewed changes

derrabus added the Validator label Mar 24, 2023

carsonbot changed the title ~~New PasswordStrength constraint~~ [Validator] New PasswordStrength constraint Mar 24, 2023

Spomky marked this pull request as draft March 24, 2023 14:25

alanpoulain reviewed Mar 24, 2023

View reviewed changes

src/Symfony/Component/Validator/Constraints/PasswordStrength.php Outdated Show resolved Hide resolved

fabpot reviewed Mar 25, 2023

View reviewed changes

Spomky mentioned this pull request Mar 25, 2023

[Validator] Document PasswordStrength constraint symfony/symfony-docs#18124

Merged

Spomky marked this pull request as ready for review March 25, 2023 22:17

OskarStark changed the title ~~[Validator] New PasswordStrength constraint~~ [Validator] New PasswordStrength constraint Mar 26, 2023

fabpot approved these changes Mar 26, 2023

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Review labels Mar 26, 2023

Spomky force-pushed the features/validator-password-strength branch from 805ed9f to 8eb69fc Compare March 26, 2023 12:44

Spomky requested a review from alanpoulain March 26, 2023 12:51

carsonbot added Status: Needs Review and removed Status: Reviewed labels Mar 26, 2023

Spomky requested review from 94noni and removed request for alanpoulain March 26, 2023 12:51

fabpot requested changes Mar 26, 2023

View reviewed changes

carsonbot added Status: Needs Work and removed Status: Needs Review labels Mar 26, 2023

chalasr approved these changes Mar 26, 2023

View reviewed changes

carsonbot added Status: Reviewed and removed Status: Needs Work labels Mar 26, 2023

fabpot reviewed Mar 26, 2023

View reviewed changes

fabpot approved these changes Mar 26, 2023

View reviewed changes

[Validator] New PasswordStrength constraint

1d93f5c

fabpot force-pushed the features/validator-password-strength branch from 3c0c947 to 1d93f5c Compare March 26, 2023 16:05

fabpot merged commit c375406 into symfony:6.3 Mar 26, 2023

Spomky deleted the features/validator-password-strength branch March 26, 2023 16:08

chalasr mentioned this pull request Mar 27, 2023

[Validator] Revert "feature #49789 New PasswordStrength constraint (Spomky)" #49831

Closed

nicolas-grekas mentioned this pull request Apr 24, 2023

[Validator] Update the name of a password strength level #50133

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Validator] New `PasswordStrength` constraint #49789

[Validator] New `PasswordStrength` constraint #49789

Spomky commented Mar 23, 2023 •

edited

Loading

lyrixx commented Mar 23, 2023

94noni left a comment

94noni Mar 24, 2023

Spomky Mar 24, 2023

94noni Mar 24, 2023

OskarStark commented Mar 24, 2023

fabpot left a comment

andreybolonin commented Mar 26, 2023

fabpot left a comment

Spomky commented Mar 26, 2023

fabpot Mar 26, 2023

Spomky Mar 26, 2023

chalasr left a comment

fabpot Mar 26, 2023

Spomky Mar 26, 2023

fabpot commented Mar 26, 2023

Spomky commented Mar 26, 2023

nicolas-grekas commented Mar 27, 2023

[Validator] New PasswordStrength constraint #49789

[Validator] New PasswordStrength constraint #49789

Conversation

Spomky commented Mar 23, 2023 • edited Loading

lyrixx commented Mar 23, 2023

94noni left a comment

Choose a reason for hiding this comment

94noni Mar 24, 2023

Choose a reason for hiding this comment

Spomky Mar 24, 2023

Choose a reason for hiding this comment

94noni Mar 24, 2023

Choose a reason for hiding this comment

OskarStark commented Mar 24, 2023

fabpot left a comment

Choose a reason for hiding this comment

andreybolonin commented Mar 26, 2023

fabpot left a comment

Choose a reason for hiding this comment

Spomky commented Mar 26, 2023

fabpot Mar 26, 2023

Choose a reason for hiding this comment

Spomky Mar 26, 2023

Choose a reason for hiding this comment

chalasr left a comment

Choose a reason for hiding this comment

fabpot Mar 26, 2023

Choose a reason for hiding this comment

Spomky Mar 26, 2023

Choose a reason for hiding this comment

fabpot commented Mar 26, 2023

Spomky commented Mar 26, 2023

nicolas-grekas commented Mar 27, 2023

[Validator] New `PasswordStrength` constraint #49789

[Validator] New `PasswordStrength` constraint #49789

Spomky commented Mar 23, 2023 •

edited

Loading