feat: add ability to require strong passwords (ietf-tools#8828)

* feat: enforce pw strength at login

* chore(deps): add zxcvbn to requirements.txt

* feat: use zxcvbn for password strength check

* feat: validate password strength for setting pw

* feat: feedback on password change page

* refactor: avoid field validator munging

* feat: give more info about how to choose a pw

* refactor: use password_validation module

Only for changing password so; may need to update StrongPasswordAuthenticationForm to match

* feat: password min_length validdation

* refactor: use password_validation for login form

* fix: UI feedback consistent with validation

* chore: update chpw page to state length req

* chore(dev): disable password validators in dev

* fix: drop JS validation when password val disabled

* style: ruff on ChangePasswordForm

* chore: lint

* chore(dev): preserve pw validator cfg for tests

* test: fix test_change_password

* test: fix test_change_username

* test: fix test_reset_password

* style: ruff refactored tests

* chore: type lint

* feat: require pw reset for very stale accounts

* test: test stale account login

* test: rejection of short/simple PWs

* Revert "test: test stale account login"

This reverts commit ae0d90b.

* Revert "feat: require pw reset for very stale accounts"

This reverts commit 1a98ef4.

* test: disable pw validators for playwright legacy tests

* feat: make pw enforcement at login optional

Author: jennifer-richards

ietf/ietfauth/forms.py

@@ -3,16 +3,19 @@
 
 
 import re
+
 from unidecode import unidecode
 
 from django import forms
+from django.contrib.auth.models import User
+from django.contrib.auth import password_validation
 from django.core.exceptions import ValidationError
 from django.db import models
-from django.contrib.auth.models import User
 
 from ietf.person.models import Person, Email
 from ietf.mailinglists.models import Allowlisted
 from ietf.utils.text import isascii
+from .password_validation import StrongPasswordValidator
 
 from .validators import prevent_at_symbol, prevent_system_name, prevent_anonymous_name, is_allowed_address
 from .widgets import PasswordStrengthInput, PasswordConfirmationInput
@@ -170,33 +173,52 @@ class Meta:
         model = Allowlisted
         exclude = ['by', 'time' ]
 
-    
-from django import forms
-
 
 class ChangePasswordForm(forms.Form):
     current_password = forms.CharField(widget=forms.PasswordInput)
 
-    new_password = forms.CharField(widget=PasswordStrengthInput(attrs={'class':'password_strength'}))
-    new_password_confirmation = forms.CharField(widget=PasswordConfirmationInput(
-                                                    confirm_with='new_password',
-                                                    attrs={'class':'password_confirmation'}))
+    new_password = forms.CharField(
+        widget=PasswordStrengthInput(
+            attrs={
+                "class": "password_strength",
+                "data-disable-strength-enforcement": "",  # usually removed in init
+            }
+        ),
+    )
+    new_password_confirmation = forms.CharField(
+        widget=PasswordConfirmationInput(
+            confirm_with="new_password", attrs={"class": "password_confirmation"}
+        )
+    )
 
     def __init__(self, user, data=None):
         self.user = user
-        super(ChangePasswordForm, self).__init__(data)
+        super().__init__(data)
+        # Check whether we have validators to enforce
+        new_password_field = self.fields["new_password"]
+        for pwval in password_validation.get_default_password_validators():
+            if isinstance(pwval, password_validation.MinimumLengthValidator):
+                new_password_field.widget.attrs["minlength"] = pwval.min_length
+            elif isinstance(pwval, StrongPasswordValidator):
+                new_password_field.widget.attrs.pop(
+                    "data-disable-strength-enforcement", None
+                )
 
     def clean_current_password(self):
-        password = self.cleaned_data.get('current_password', None)
+        # n.b., password = None is handled by check_password and results in a failed check
+        password = self.cleaned_data.get("current_password", None)
         if not self.user.check_password(password):
-            raise ValidationError('Invalid password')
+            raise ValidationError("Invalid password")
         return password
-            
+
     def clean(self):
-        new_password = self.cleaned_data.get('new_password', None)
-        conf_password = self.cleaned_data.get('new_password_confirmation', None)
-        if not new_password == conf_password:
-            raise ValidationError("The password confirmation is different than the new password")
+        new_password = self.cleaned_data.get("new_password", "")
+        conf_password = self.cleaned_data.get("new_password_confirmation", "")
+        if new_password != conf_password:
+            raise ValidationError(
+                "The password confirmation is different than the new password"
+            )
+        password_validation.validate_password(conf_password, self.user)
 
 
 class ChangeUsernameForm(forms.Form):

ietf/ietfauth/password_validation.py

@@ -0,0 +1,23 @@
+# Copyright The IETF Trust 2025, All Rights Reserved
+from django.core.exceptions import ValidationError
+from zxcvbn import zxcvbn
+
+
+class StrongPasswordValidator:
+    message = "This password does not meet complexity requirements and is easily guessable."
+    code = "weak"
+    min_zxcvbn_score = 3
+
+    def __init__(self, message=None, code=None, min_zxcvbn_score=None):
+        if message is not None:
+            self.message = message
+        if code is not None:
+            self.code = code
+        if min_zxcvbn_score is not None:
+            self.min_zxcvbn_score = min_zxcvbn_score
+
+    def validate(self, password, user=None):
+        """Validate that a password is strong enough"""
+        strength_report = zxcvbn(password[:72], max_length=72)
+        if strength_report["score"] < self.min_zxcvbn_score:
+            raise ValidationError(message=self.message, code=self.code)