Implement password strength requirements

1 files changed, 10 insertions, 0 deletions

diff --git a/backend/src/authn.js b/backend/src/authn.js
index c6c4a2e..40c7da8 100644
--- a/backend/src/authn.js
+++ b/backend/src/authn.js
@@ -2,6 +2,7 @@ const base64 = require('base-64');
 const sha512 = require('js-sha512');
 const shortid = require('shortid');
 const db = require('./db');
+const owaspPw = require('owasp-password-strength-test');
 
 const buildSessionCookie = ({ username, sessionToken, isLogout }) => {
   if (!isLogout) {
@@ -78,6 +79,15 @@ const registerRoute = async (req, res) => {
     });
   }
 
+  const owaspPwTestResults = owaspPw.test(password);
+  if (!owaspPwTestResults.strong) {
+    res.status(400);
+    return res.json({
+      error: 'Password not strong enough',
+      errors: owaspPwTestResults.errors,
+    });
+  }
+
   const salt = shortid.generate();
   const pwHash = sha512(salt + password);