Skip to content

Fix/issue 2357 backend password complexity#2364

Open
Prateek2007-cmd wants to merge 3 commits into
janavipandole:mainfrom
Prateek2007-cmd:fix/issue-2357-backend-password-complexity
Open

Fix/issue 2357 backend password complexity#2364
Prateek2007-cmd wants to merge 3 commits into
janavipandole:mainfrom
Prateek2007-cmd:fix/issue-2357-backend-password-complexity

Conversation

@Prateek2007-cmd

Copy link
Copy Markdown
Contributor

Description

Resolves Issue #2357 (Missing Backend Password Complexity Validation).

The UserRegister validation layer previously suffered from a dangerous "Client-Side Trust" vulnerability. While the frontend rigorously verified password composition, the backend Pydantic model (password_complexity) only checked for a single digit and an uppercase character. This allowed malicious actors bypassing the UI to easily register weak, brute-forceable passwords.

This PR establishes zero-trust backend enforcement of cryptographic composition rules.

Changes Made

  • Strict Composition Policy: Extended the password_complexity validator in backend/app/schemas.py to mandate the presence of lowercase letters [a-z] and special characters [@$!%*?&].
  • API Hardening: Any automated request attempting to register a non-compliant password will now reliably hit a 422 Unprocessable Entity response, successfully stopping brute-force dictionary attacks.

Type of Change

  • Security Fix
  • Data Validation

@vercel

vercel Bot commented Jun 20, 2026

Copy link
Copy Markdown

@Prateek2007-cmd is attempting to deploy a commit to the janavipandole's projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant