4 files changed, 27 insertions, 0 deletions
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 6d7cd28..d86cb73 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -1733,6 +1733,11 @@
       "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz",
       "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA=="
     },
+    "owasp-password-strength-test": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/owasp-password-strength-test/-/owasp-password-strength-test-1.3.0.tgz",
+      "integrity": "sha1-T2KeQpA+j20nmyMNZXq2HljkSxI="
+    },
     "p-finally": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/p-finally/-/p-finally-1.0.0.tgz",
diff --git a/backend/package.json b/backend/package.json
index e6b64b3..daba5f7 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -19,6 +19,7 @@
     "js-sha512": "^0.8.0",
     "knex": "^0.20.8",
     "morgan": "^1.9.1",
+    "owasp-password-strength-test": "^1.3.0",
     "pg": "^7.18.1",
     "shortid": "^2.2.15"
   },
diff --git a/backend/src/authn.js b/backend/src/authn.js
index c6c4a2e..40c7da8 100644
--- a/backend/src/authn.js
+++ b/backend/src/authn.js
@@ -2,6 +2,7 @@ const base64 = require('base-64');
 const sha512 = require('js-sha512');
 const shortid = require('shortid');
 const db = require('./db');
+const owaspPw = require('owasp-password-strength-test');
 
 const buildSessionCookie = ({ username, sessionToken, isLogout }) => {
   if (!isLogout) {
@@ -78,6 +79,15 @@ const registerRoute = async (req, res) => {
     });
   }
 
+  const owaspPwTestResults = owaspPw.test(password);
+  if (!owaspPwTestResults.strong) {
+    res.status(400);
+    return res.json({
+      error: 'Password not strong enough',
+      errors: owaspPwTestResults.errors,
+    });
+  }
+
   const salt = shortid.generate();
   const pwHash = sha512(salt + password);
 
diff --git a/backend/src/index.js b/backend/src/index.js
index 128ed60..6b196f3 100644
--- a/backend/src/index.js
+++ b/backend/src/index.js
@@ -6,6 +6,17 @@ const routes = require('./routes');
 
 const app = express();
 
+app.use((_, res, next) => {
+  try {
+    next();
+  } catch (err) {
+    console.error(err);
+    res.status(500);
+    res.json({
+      error: 'Internal server error',
+    });
+  }
+});
 app.use(morgan('dev'));
 app.use(bodyParser.json());
 app.use(cookieParser());