sstream17 / chat-2 Goto Github PK

When a user creates an account, add password strength validation to encourage strong passwords. We shouldn't enforce anything too harsh on users. At a minimum we could try:

• Min length = 8
• Passwords categorized as weakest should be disallowed

Look into zxcvbn. It might be a good fit.

There are a few issues with the username tag generator:

• How do we handle tags when a user is deleted or changes their username?
  • This would leave a gap in usable tags, e.g. ["user:0123", "user:0124", "user:0125"] now "0124" is an open tag again
  • Do we immediately fill the gap? Have to keep track of where gaps are to fill them
  • Do we keep counting up from the last available?
• I am not a big fan of incrementing the tags by 1, even though they all start at a different number for the input username
  • This seems too predictable, is probably not a security risk but I'd like to make it seem more random

Finish up the input validation when creating a new account.