From ff1391298ef9dee77156ec71e622dc009d705c67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Mon, 6 Jun 2022 16:03:35 +0200 Subject: [PATCH] Perform initial password validation sooner Avoid user creation in case things are not yet validated. --- system/service/auth.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/system/service/auth.go b/system/service/auth.go index 0ce55e7b5..466c01f43 100644 --- a/system/service/auth.go +++ b/system/service/auth.go @@ -377,6 +377,15 @@ func (svc auth) InternalSignUp(ctx context.Context, input *types.User, password // // return nil,nil + // @note moved the password check higher up so we can terminate the proc + // sooner. + // + // The check must be after the login fallback so that we still allow + // logins with old passwords in case the policy has changed since then. + if !svc.CheckPasswordStrength(password) { + return AuthErrPasswordNotSecure() + } + var nUser = &types.User{ ID: nextID(), CreatedAt: *now(),