https://github.com/tdgroot/magento2-module-pwned-validator

Add 'Have I been pwned?' validation to Magento 2.
https://github.com/tdgroot/magento2-module-pwned-validator

magento2 magento2-module pwned pwnedpasswords validator

Last synced: 11 days ago
JSON representation

Add 'Have I been pwned?' validation to Magento 2.

• Host: GitHub
• URL: https://github.com/tdgroot/magento2-module-pwned-validator
• Owner: tdgroot
• License: mit
• Created: 2018-03-11T10:30:10.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2020-05-17T20:57:26.000Z (over 4 years ago)
• Last Synced: 2024-04-18T06:27:07.064Z (7 months ago)
• Topics: magento2, magento2-module, pwned, pwnedpasswords, validator
• Language: PHP
• Homepage:
• Size: 10.7 KB
• Stars: 7
• Watchers: 2
• Forks: 2
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# Magento 2 Have I Been Pwned Validator

This module adds a validator which checks if the submitted password is found in public databases using the `Have I Been Pwned?` service.

## Security

There are no security drawbacks, because there are no actual passwords being submitted over the internet. This is possible by hashing the password using the `SHA-1` algorithm and request all hashes in the `Have I been Pwned?` databases starting with the first 5 characters of the password hash. This resultset contains a list of hashes and the amount of occurrences.

This way the password stays inside the Magento process.

## Installation

```

composer require timpack/magento2-module-pwned-validator

bin/magento setup:upgrade

``` 

## Configuration

You can configure the threshold of the validator, at which count of occurrences in the resultset the password should be considered insecure/invalid.

This configuration can be found at:

`Stores -> Configuration -> Customer -> Customer Configuration -> Pwned Validator -> Minimum amount of matches`

## Credits

This module was heavily inspired by Valorin's Pwned validator written for Laravel: [valorin/pwned-validator](https://github.com/valorin/pwned-validator)