fix(auth): treat zxcvbn suggestions as advice, not blocking errors (#1247)

Browse Source

Stable twin of #1050. passwordValidation.js is byte-identical between the
branches, so this is the same change verbatim.

validatePassword() appended zxcvbn's feedback.suggestions to the errors
array unconditionally, and validity is errors.length === 0 — so any
password that merely earned a suggestion was rejected even when it
satisfied every configured rule. The effective policy was stricter than
the configured complexity level and invisible to the admin.

Co-authored-by: Paul Nothaft <[email protected]>
Co-authored-by: Peifu Mo <[email protected]>

...

This commit is contained in:

Paul Nothaft

2026-09-01 08:16:33 +02:00

committed by GitHub

co-authored by Paul Nothaft Peifu Mo

parent eebca9900b

commit 5b69e3ec4c

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

Diff Content Not Available