password strength

[bourgeoa]

check minimal password strength : actually there is no control
https://github.com/CommunitySolidServer/CommunitySolidServer/blob/262cdee72c5af492294159e8a4da142cb0793e5e/templates/scripts/util.js#L181
https://dev.to/themodernweb/here-is-how-i-made-a-strong-password-checker-using-javascript-3m9o

[thhck]

Indeed !

However I think the verification should happen in the backend.
It can be done using yup here:
https://github.com/CommunitySolidServer/CommunitySolidServer/blob/262cdee72c5af492294159e8a4da142cb0793e5e/src/identity/interaction/password/PasswordLoginHandler.ts#L13-L17

Or as part of the BasePasswordStore

The first method is easier but could be bypassed if the passwordStore is used somewhere else. The second is a bit harder to implement but make password strength a must to add a password to the store.

[bourgeoa]

Very interesting. Yup is a nice module.
You have https://github.com/knicola/yup-password.

Shall the control be by-passed on tests for example ? Or when seeding accounts?