hec-franco / password-policy-bundle
Password policy enforcements for symfony 6|7
Requires
- php: ^8.1|^8.2|^8.3|^8.4
- nesbot/carbon: ^3.9
- symfony/framework-bundle: ^6.0|^7.0
- symfony/validator: ^6.0|^7.0
Requires (Dev)
- mockery/mockery: ^1.6
- phpunit/phpunit: ^7.5|^8.0|^9.0|^10.0
README
Installation
composer require despark/password-policy-bundle
Configuration
-
Implement
HecFranco\PasswordPolicyBundle\Model\HasPasswordPolicyInterface
in the entities that you want to support password policies. -
Implement
HecFranco\PasswordPolicyBundle\Model\PasswordHistoryInterface
in a new entity that will hold the password history records. -
Configure how Password policy will behave on every entity. Configuration example is here
-
You need to add
@PasswordPolicy()
validation rules to your$plainPassword
field
Configuration example:
hec_franco_password_policy:
entities:
# the entity class implementing HasPasswordPolicyInterface
App\Entity\Participant:
# The route where the user will be notified when password is expired
notified_routes:
- participant_profile
# These routes will be excluded from the expiry check
excluded_notified_routes: ~
# Which is the password property in the entity (defaults to 'password')
password_field: ~
# Password history property in the entity (default to 'passwordHistory')
password_history_field: ~
# How many password changes to track (defaults to 3)
passwords_to_remember: ~
# Force expiry of the password in that many days
expiry_days: ~
App\Entity\User:
notified_routes:
- admin_app_user_edit
expiry_listener:
# You can change the expiry listener priority
priority: 0
error_msg:
text:
title: 'Your password expired.'
message: 'You need to change it'
type: 'error'
listener_priority: 0
# The route that needs to be shown to the user when password is expired
lock_route: participant_settings
Expiry
Expiry works by checking last password change on every request made to the app, excluding those configured in the application
Good to know
The library uses doctrine lifecycle events to create password history and set last password change on the target entities. In order for this to happen we use the onFlush event and we are recalculating the history change set inside it. You must be aware of that as any entity changes after the recalculation will not be persisted to the database.