Wt  3.3.0
Public Types | Public Member Functions | Static Public Attributes
Wt::Auth::PasswordStrengthValidator Class Reference

A default implementation for password strength validation. More...

Inheritance diagram for Wt::Auth::PasswordStrengthValidator:
Inheritance graph
[legend]

List of all members.

Public Types

enum  PasswordType {
  OneCharClass, TwoCharClass, PassPhrase, ThreeCharClass,
  FourCharClass
}
 Enumeration for a password type. More...

Public Member Functions

 PasswordStrengthValidator ()
 Default constructor.
void setMinimumLength (PasswordType type, int length)
 Sets the minimum length for a password of a certain type.
int minimumLength (PasswordType type)
 Returns the minimum length for a password of a certain type.
void setMinimumPassPhraseWords (int words)
 Sets the minimum number of words for a pass phrase.
int minimumPassPhraseWords () const
 Returns the minimum number of words for a pass phrase.
void setMinimumMatchLength (int length)
 Sets the minimum length for a match against a known sequence or the login name / email address.
int minimumMatchLength () const
 Returns the minimum length for a match against a known sequence.
virtual
AbstractPasswordService::StrengthValidatorResult 
evaluateStrength (const WString &password, const WString &loginName, const std::string &email) const
 Evaluates the strength of a password.

Static Public Attributes

static const int Disabled = std::numeric_limits<int>::max()
 Sentinel value to disable a particular check.

Detailed Description

A default implementation for password strength validation.

This implementation uses http://www.openwall.com/passwdqc/, a password checker commonly used to validate user account passwords in Linux/BSD distributions.

The default settings are not as restrictive as those used originally by passwdqc (which could be frustratingly restrictive for a web application). You may want to make it change the settings to demand stronger passwords for sensitive applications.


Member Enumeration Documentation

Enumeration for a password type.

An entered password will be classified as one of these types, based on the different characters used.

The classification uses the concept of character classes, and defines five classes:

  • lower case letters
  • upper case letters
  • numbers
  • other ascii characters
  • unknowns (i.e. multi-byte UTF-8 sequences)

For determining the number of classes, capitializaiton of the first letter of a word, or appending a number, does not count as an extra class.

Enumerator:
OneCharClass 

A password with characters of only one class.

The default minimum length required for this password type is 20 characters.

Note:
the default of passwdqc is Disabled
TwoCharClass 

A password with characters of two classes.

The default minimum length required for this password type is 15 characters.

Note:
the default of passwdqc is 24 characters
PassPhrase 

A password that consists of multiple words.

The default minimum length required for this password type is 11 characters.

See also:
setMinPassPhraseWords()
Note:
the default of passwdqc is also 11 characters
ThreeCharClass 

A password with characters of three classes.

The default minimum length required for this password type is 8 characters.

Note:
the default of passwdqc is also 8 characters
FourCharClass 

A password with characters of four classes.

The default minimum length required for this password type is 7 characters.

Note:
the default of passwdqc is also 7 characters

Member Function Documentation

AbstractPasswordService::StrengthValidatorResult Wt::Auth::PasswordStrengthValidator::evaluateStrength ( const WString password,
const WString loginName,
const std::string &  email 
) const [virtual]

Evaluates the strength of a password.

The result is an instance of StrengthValidatorResult which contains information on the validity and the strength (0 if invalid, 5 if valid) of the password together with possible messages.

The validator takes into account the user's login name and email address, to exclude passwords that are too similar to these.

Implements Wt::Auth::AbstractPasswordService::AbstractStrengthValidator.

int Wt::Auth::PasswordStrengthValidator::minimumLength ( PasswordType  type)

Returns the minimum length for a password of a certain type.

See also:
setMinimumLength()
int Wt::Auth::PasswordStrengthValidator::minimumMatchLength ( ) const

Returns the minimum length for a match against a known sequence.

See also:
setMinimumMatchLength()
int Wt::Auth::PasswordStrengthValidator::minimumPassPhraseWords ( ) const

Returns the minimum number of words for a pass phrase.

See also:
setMinimumPassPhraseWords()
void Wt::Auth::PasswordStrengthValidator::setMinimumLength ( PasswordType  type,
int  length 
)

Sets the minimum length for a password of a certain type.

See the PasswordType documentation for defaults. You may disable a password of a certain class entirely using the special value Disabled.

void Wt::Auth::PasswordStrengthValidator::setMinimumMatchLength ( int  length)

Sets the minimum length for a match against a known sequence or the login name / email address.

Irrespective of other settings, a password may be checked not to contain common sequences.

This sets the minimum number of characters which is considered as a match of a password against a known sequence. A lower length setting is thus more stringent.

The default value is 4.

void Wt::Auth::PasswordStrengthValidator::setMinimumPassPhraseWords ( int  words)

Sets the minimum number of words for a pass phrase.

Sets the minimum number of words for a valid pass phrase.

The default value is 3.

See also:
PassPhrase
 All Classes Namespaces Functions Variables Typedefs Enumerations Enumerator

Generated on Mon Apr 8 2013 for the C++ Web Toolkit (Wt) by doxygen 1.7.5.1