winter / wn-pwnedpasswords-plugin
Adds the notpwned validation rule to check passwords against the HIBP Pwned Passwords service
Fund package maintenance!
wintercms
Open Collective
Installs: 1 464
Dependents: 0
Suggesters: 0
Security: 0
Stars: 4
Watchers: 5
Forks: 3
Open Issues: 1
Type:winter-plugin
Requires
- ext-curl: *
- composer/installers: ~1.11
This package is auto-updated.
Last update: 2024-10-24 03:38:01 UTC
README
Adds the notpwned:min
validation rule to check values against the HaveIBeenPwned Pwned Passwords service using the ranged search (k-anonymity) feature for privacy & security. If a value has been pwned more than :min
(1 by default) times, then the provided value will fail validation.
Installation
To install from the Marketplace, click on the "Add to Project" button and then select the project you wish to add it to before updating the project to pull in the plugin.
To install from the backend, go to Settings -> Updates & Plugins -> Install Plugins and then search for Winter.PwnedPasswords
.
To install from the repository, clone it into plugins/winter/pwnedpasswords and then run composer update
from your project root in order to pull in the dependencies.
To install it with Composer, run composer require winter/wn-pwnedpasswords-plugin
from your project root.
Documentation
Limiting by the number of times the password was pwned
You can limit rejected passwords to those that have been pwned a minimum number of times.
For example, password
has been pwned 3,303,003 times, however P@ssword!
has only been pwned 118 times.
If we wanted to block password
but not P@ssword!
, we can specify the minimum number as 150 like this:
'password' => 'required|string|min:6|notpwned:150|confirmed',
Enforce this rule on Backend authentication
To enforce this rule on the Backend authentication system, create a file at config/winter/pwnedpasswords/config.php
and put the following in it:
<?php return [ /* |-------------------------------------------------------------------------- | Enforce "notpwned" rule on backend users |-------------------------------------------------------------------------- | | When this is enabled, the 'notpwned' validation rule is enforced on all | backend users by default. This means that they will not be able to update | their password to any password detected in a password breach, and if a | backend user tries to login with a "pwned" password, they will be rejected | and a password reset email will be sent to their email address for them to | change their password. */ 'enforceOnBackendUsers' => true, ];
Overriding the validation message
To override the validation message, duplicate the plugin's lang/en/lang.php
file to project/lang/$locale/winter/pwnedpasswords/lang.php
.