supabase / gotrue / 7044370967

65%

push

github

feat: add haveibeenpwned.org password strength check (#1324)

Uses Supabase's HIBP Go library to perform password strength checks
using the HaveIBeenPwned.org Pwned Passwords API.

You can configure this behavior by:

- `GOTRUE_PASSWORD_HIBP_ENABLED` to turn it on
- `GOTRUE_PASSWORD_HIBP_USER_AGENT` to specify your project's identifier
- `GOTRUE_PASSWORD_HIBP_FAIL_CLOSED` if the API is unavailable (or
unresponsive for 5 seconds) the response is ignored and any password is
accepted, set this to true to fail with a 500 error in such cases
- `GOTRUE_PASSWORD_HIBP_BLOOM_ENABLED` to enable a bloom filter cache
- `GOTRUE_PASSWORD_HIBP_BLOOM_ITEMS` to specify the maximum number of
pwned password hashes to be stored in the bloom filter
- `GOTRUE_PASSWORD_HIBP_BLOOM_FALSE_POSITIVES` to specify the maximum
number of false positives returned by the bloom filter, a value between
0 and 1 indicating _1 in X_

For bloom filters, use this calculator to understand the values:
https://hur.st/bloomfilter

By default 100,000 password hashes can be stored in the filter (about
100 hash prefixes). The filter resets at 80% of this value to ensure
that the cache is cleared and the actual false positive rate does not go
too high.

2 of 76 new or added lines in 3 files covered. (2.63%)

7723 of 11873 relevant lines covered (65.05%)

53.35 hits per line