hclarsen / devise-uncommon_password

Devise extension to prevent users from using a common password.

Devise Uncommon Password

Devise::UncommonPassword is an extension for the devise gem, which prevents users from signing up using one of the 100 most common passwords. The list is derived from the darkweb2017_top10K.txt found at: https://github.com/danielmiessler/SecLists/tree/master/Passwords.

Usage

Add the :uncommon_password module to your model:

class AdminUser < ApplicationRecord
  devise :database_authenticatable,
         :recoverable, :rememberable, :trackable, :validatable, :uncommon_password
end

By default, the password is checked against the 100 most common passwords that fit within the minimum and maximum lengths specified in the /config/initializers/devise.rb file. However, if a developer wants to check against a larger list, they may override this default by adding the following line to that same file:

# Number of common passwords to check entered password against.
config.password_matches = 1000

Internationalization and Customization

The default message for users who attempt to use a common password is:

is a very common password. Please choose something harder to guess.

This can be changed by modifying the devise.en.yml file, under errors/messages/common_password. Translations can be provided using the devise translation files in the same location.

en:
  errors:
    messages:
      common_password: 'is a very common password. Please choose something harder to guess.'

Installation

Add this line to your application's Gemfile:

gem 'devise-uncommon_password'

And then execute:

$ bundle install

Contributing

You can contribute by doing the following:

• Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
• Fork it
• Write your changes
• Test
• Commit
• Send a pull request

License

The gem is available as open source under the terms of the MIT License.

devise-uncommon_password's Issues

Devise 4.8 support?

I'm looking to potentially use this gem, but according to the gemspec and rubygems, Devise 4.8 isn't supported, so I'd have to downgrade.

Is it possible to add support for this? I'm not sure if this is trivial or difficult, but this version has been out for about 6 months now.

Incompatible with devise 4.9 and therefore incompatible with turbo

devise >= 3.5, < 4.9

Integrate with PwnedPasswords API

I'm happy to create a PR for this, mainly checking if you are interested in the idea/think it makes sense for this gem.

I would like to add a configuration to uncommon_password to call

https://haveibeenpwned.com/API/v2#PwnedPasswords

This would be opt in, as people already using the gem may not want hashed user passwords being sent to a third party.

Still maintained? + Localization support

Is this gem still maintained?

If so, it would be great if you can allow localization of the error message.

This block

devise-uncommon_password/lib/devise/uncommon_password/model.rb

Lines 33 to 37 in cca8f40

	def not_common_password
	if Devise::Models::UncommonPassword.common_passwords.include? password.downcase
	errors.add(:password, "is a very common password. Please choose something harder to guess.")
	end
	end

Should probably just have something like:

errors.add(:password, :common)

Which will just allow us to define the message in a localization file:

# config/locales/activerecord.en.yml
en:
  activerecord: 
    errors:
      models:
        user:
          attributes:
            password:
              common: "must not be a commonly used password"

Rails 7.1 support

Hi!
Rails 7.1 was released on October 5.
Could you update the gem to support this version?
Thanks!

Rails 7.1: Dockerfiles, BYO Authentication, More Async Queries, and more!

Rails 5.2 support

Currently it depends on rails (< 5.2, >= 4.2).

Longer Password list

If you find that 100 passwords is not enough, here's my go-to password list:
https://github.com/danielmiessler/SecLists/tree/master/Passwords