2 files changed, 21 insertions, 0 deletions
diff --git a/backend/src/authn.js b/backend/src/authn.js
index c6c4a2e..40c7da8 100644
--- a/backend/src/authn.js
+++ b/backend/src/authn.js
@@ -2,6 +2,7 @@ const base64 = require('base-64');
 const sha512 = require('js-sha512');
 const shortid = require('shortid');
 const db = require('./db');
+const owaspPw = require('owasp-password-strength-test');
 
 const buildSessionCookie = ({ username, sessionToken, isLogout }) => {
   if (!isLogout) {
@@ -78,6 +79,15 @@ const registerRoute = async (req, res) => {
     });
   }
 
+  const owaspPwTestResults = owaspPw.test(password);
+  if (!owaspPwTestResults.strong) {
+    res.status(400);
+    return res.json({
+      error: 'Password not strong enough',
+      errors: owaspPwTestResults.errors,
+    });
+  }
+
   const salt = shortid.generate();
   const pwHash = sha512(salt + password);
 
diff --git a/backend/src/index.js b/backend/src/index.js
index 128ed60..6b196f3 100644
--- a/backend/src/index.js
+++ b/backend/src/index.js
@@ -6,6 +6,17 @@ const routes = require('./routes');
 
 const app = express();
 
+app.use((_, res, next) => {
+  try {
+    next();
+  } catch (err) {
+    console.error(err);
+    res.status(500);
+    res.json({
+      error: 'Internal server error',
+    });
+  }
+});
 app.use(morgan('dev'));
 app.use(bodyParser.json());
 app.use(cookieParser());