module Devise::Models::PwnedPassword
The PwnedPassword
module adds a new validation for Devise
Models
. No modifications to routes or controllers needed. Simply add :pwned_password to the list of included modules in your devise module, and all new registrations will be blocked if they use a password in this dataset haveibeenpwned.com/Passwords.
Attributes
pwned_count[W]
Public Instance Methods
password_pwned?(password)
click to toggle source
Returns true if password is present in the PwnedPasswords dataset
# File lib/devise/pwned_password/model.rb, line 46 def password_pwned?(password) puts %(pwned_count=#{(pwned_count).inspect}) puts %(persisted?=#{(persisted?).inspect}) puts %(self.class.min_password_matches_warn=#{(self.class.min_password_matches_warn).inspect}) @pwned = @pwned_count >= (persisted? ? self.class.min_password_matches_warn || self.class.min_password_matches : self.class.min_password_matches) return @pwned end
pwned?()
click to toggle source
# File lib/devise/pwned_password/model.rb, line 36 def pwned? @pwned ||= false end
pwned_count()
click to toggle source
# File lib/devise/pwned_password/model.rb, line 40 def pwned_count @pwned_count ||= 0 end
Private Instance Methods
not_pwned_password_warn()
click to toggle source
# File lib/devise/pwned_password/model.rb, line 56 def not_pwned_password_warn # This deliberately fails silently on 500's etc. Most apps won't want to tie the ability to sign up users to the availability of a third-party API. if password_pwned?(password) errors.add(:password, :pwned_password, count: @pwned_count) end end