Wt: Wt::Auth::PasswordStrengthValidator Class Reference

Wt 3.3.0

- Main Page
- Related Pages
- Modules
- Namespaces
- Classes

- Class List
- Class Hierarchy
- Class Members

Public Types | Public Member Functions | Static Public Attributes
Wt::Auth::PasswordStrengthValidator Class Reference
Authentication module (Wt::Auth)

A default implementation for password strength validation. More...

Inheritance diagram for Wt::Auth::PasswordStrengthValidator:
[legend]

List of all members.

## Public Types
enum | PasswordType { OneCharClass, TwoCharClass, PassPhrase, ThreeCharClass, FourCharClass }
| Enumeration for a password type. More...
## Public Member Functions
| PasswordStrengthValidator ()
| Default constructor.
void | setMinimumLength (PasswordType type, int length)
| Sets the minimum length for a password of a certain type.
int | minimumLength (PasswordType type)
| Returns the minimum length for a password of a certain type.
void | setMinimumPassPhraseWords (int words)
| Sets the minimum number of words for a pass phrase.
int | minimumPassPhraseWords () const
| Returns the minimum number of words for a pass phrase.
void | setMinimumMatchLength (int length)
| Sets the minimum length for a match against a known sequence or the login name / email address.
int | minimumMatchLength () const
| Returns the minimum length for a match against a known sequence.
virtual AbstractPasswordService::StrengthValidatorResult | evaluateStrength (const WString &password, const WString &loginName, const std::string &email) const
| Evaluates the strength of a password.
## Static Public Attributes
static const int | Disabled = std::numeric_limits<int>::max()
| Sentinel value to disable a particular check.

## Detailed Description

A default implementation for password strength validation.

This implementation uses http://www.openwall.com/passwdqc/, a password checker commonly used to validate user account passwords in Linux/BSD distributions.

The default settings are not as restrictive as those used originally by passwdqc (which could be frustratingly restrictive for a web application). You may want to make it change the settings to demand stronger passwords for sensitive applications.

## Member Enumeration Documentation

enum Wt::Auth::PasswordStrengthValidator::PasswordType

Enumeration for a password type.

An entered password will be classified as one of these types, based on the different characters used.

The classification uses the concept of character classes, and defines five classes:

- lower case letters
- upper case letters
- numbers
- other ascii characters
- unknowns (i.e. multi-byte UTF-8 sequences)

For determining the number of classes, capitializaiton of the first letter of a word, or appending a number, does not count as an extra class.

Enumerator:

  OneCharClass | A password with characters of only one class. The default minimum length required for this password type is 20 characters. Note: the default of passwdqc is Disabled
  TwoCharClass | A password with characters of two classes. The default minimum length required for this password type is 15 characters. Note: the default of passwdqc is 24 characters
  PassPhrase | A password that consists of multiple words. The default minimum length required for this password type is 11 characters. See also: setMinPassPhraseWords() Note: the default of passwdqc is also 11 characters
  ThreeCharClass | A password with characters of three classes. The default minimum length required for this password type is 8 characters. Note: the default of passwdqc is also 8 characters
  FourCharClass | A password with characters of four classes. The default minimum length required for this password type is 7 characters. Note: the default of passwdqc is also 7 characters

## Member Function Documentation

AbstractPasswordService::StrengthValidatorResult Wt::Auth::PasswordStrengthValidator::evaluateStrength | ( | const WString & | password,
|  | const WString & | loginName,
|  | const std::string & | email
| ) |  | const`[virtual]`

Evaluates the strength of a password.

The result is an instance of StrengthValidatorResult which contains information on the validity and the strength (0 if invalid, 5 if valid) of the password together with possible messages.

The validator takes into account the user's login name and email address, to exclude passwords that are too similar to these.

Implements Wt::Auth::AbstractPasswordService::AbstractStrengthValidator.

int Wt::Auth::PasswordStrengthValidator::minimumLength | ( | PasswordType | type | ) |

Returns the minimum length for a password of a certain type.

See also:
  setMinimumLength()

int Wt::Auth::PasswordStrengthValidator::minimumMatchLength | ( |  | ) | const

Returns the minimum length for a match against a known sequence.

See also:
  setMinimumMatchLength()

int Wt::Auth::PasswordStrengthValidator::minimumPassPhraseWords | ( |  | ) | const

Returns the minimum number of words for a pass phrase.

See also:
  setMinimumPassPhraseWords()

void Wt::Auth::PasswordStrengthValidator::setMinimumLength | ( | PasswordType | type,
|  | int | length
| ) |  |

Sets the minimum length for a password of a certain type.

See the PasswordType documentation for defaults. You may disable a password of a certain class entirely using the special value Disabled.

void Wt::Auth::PasswordStrengthValidator::setMinimumMatchLength | ( | int | length | ) |

Sets the minimum length for a match against a known sequence or the login name / email address.

Irrespective of other settings, a password may be checked not to contain common sequences.

This sets the minimum number of characters which is considered as a match of a password against a known sequence. A lower `length` setting is thus more stringent.

The default value is 4.

void Wt::Auth::PasswordStrengthValidator::setMinimumPassPhraseWords | ( | int | words | ) |

Sets the minimum number of words for a pass phrase.

Sets the minimum number of words for a valid pass phrase.

The default value is 3.

See also:
  PassPhrase

All Classes Namespaces Functions Variables Typedefs Enumerations Enumerator