0

I need to check for password complexity on a flask user registration form. I thought about using the password_strength python library but didn't have much success with it. I only need to check to make sure the password matches the following criteria:

Min of 12 char at least 1 UC at least 1 LC at least 1 Num at least 1 Sym

Here is my Login Registration code within Flask:

@auth.route('/signup', methods=['POST'])
def signup_post():

    email = request.form.get('email')
    name = request.form.get('name')
    password = request.form.get('password')
    # if re.match(r"^(?=.*[\d])(?=.*[A-Z])(?=.*[a-z])(?=.*[@#$])[\w\d@#$]{6,12}$", password):

    user = User.query.filter_by(email=email).first()  # check to see if user already exists

    if user:  # if a user is found, we want to redirect back to signup page so user can try again
        flash('email address already exists')
        return redirect(url_for('auth.signup'))

    new_user = User(email=email, name=name, password=generate_password_hash(password, method='sha256'))

    # add the new user to the database
    db.session.add(new_user)
    db.session.commit()

    return redirect(url_for('auth.login'))

As you can see, I was thinking of using a regex to perform this task but I'm not sure how to inform the user the password doesn't meet the complexity requirements and re-prompt for a more secure password. Thanks

just1han85
  • 313
  • 1
  • 4
  • 14
  • You could check the different criteria with regex and then grant the password a security score based on each result and return a message accordingly. If it's too weak, you can return a message with the expected security measures required and render it on your website. – Leandro Esteban Oct 07 '20 at 16:12
  • Is there really no decent library to help with this problem? – just1han85 Oct 08 '20 at 01:25

1 Answers1

2

Best way would be a regular expression search function that returns the errors in the complexity of the password. Take a look at this.

xemeds
  • 316
  • 1
  • 12
  • I ended up using javascript in my html to perform this task on the client side instead of having to deal with Python code to do this. I still had to use some regex on the javascript side to make it works. Thanks – just1han85 Oct 09 '20 at 02:56