Skip to main content

Weak credential policy - Password strength

Need​

Implementation of a strong password policy

Context​

  • Usage of Ruby 2.3+ as the required version for running the application
  • Usage of bcrypt for password hashing and encryption

Description​

Non compliant code​

class User < ApplicationRecord
  has_secure_password
end

The above code represents a model User in a Ruby on Rails application. The has_secure_password method is used to handle password hashing in the database. However, this method alone does not enforce any kind of password complexity or length requirements, which is a security vulnerability.

This can lead to weak passwords being used by users, which are easier to crack and can lead to unauthorized access to user accounts. A weak credential policy can be exploited through brute force or dictionary attacks.

In this code, there's no policy in place to ensure the password contains a minimum number of characters, upper and lower case letters, numbers, and special characters. This means a user could potentially have a password as simple as "password" or "1234", which are extremely easy to guess or crack.

Steps​

  • Implement a password strength policy that enforces minimum requirements for passwords.
  • Define the minimum requirements for passwords, such as minimum length, required character types (e.g., uppercase, lowercase, numbers, special characters), and any other relevant criteria.
  • Update the User model to include validations for password strength based on the defined requirements.
  • Use a password hashing algorithm that is considered secure, such as bcrypt, to store the passwords securely.
  • Educate users about the password strength requirements and provide guidance on creating strong passwords.
  • Implement a mechanism to enforce password changes periodically or when there is suspicion of compromise.
  • Regularly review and update the password strength policy as needed to adapt to evolving security threats.

Compliant code​

class User < ApplicationRecord
  has_secure_password
  validates :password, format: { with: /\\A(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?&])[A-Za-z\\d@$!%*?&]{8,}\\z/,
    message: "must be at least 8 characters long, include at least one uppercase letter, one lowercase letter, one number, and one special character" }
end

The updated code includes a validation for the password attribute of the User model. This validation uses a regular expression to enforce the following password strength requirements:

  • At least 8 characters long
  • At least one uppercase letter
  • At least one lowercase letter
  • At least one number
  • At least one special character

The has_secure_password method is a built-in Rails method that includes password hashing using bcrypt, which is a secure password hashing algorithm. This method also automatically adds a presence validation for the password field.

The validation error message provides clear guidance to users about the password strength requirements.

This code update helps to mitigate the risk of weak passwords, which can be easily guessed or cracked by attackers. By enforcing a strong password policy, the system can better protect user accounts and sensitive data from unauthorized access.

Remember to educate users about the password strength requirements and the importance of using strong passwords. Also, consider implementing a mechanism to enforce password changes periodically or when there is suspicion of compromise. Regularly review and update the password strength policy as needed to adapt to evolving security threats.

References​

Last updated on