module Devise::Models::PwnedPassword

The PwnedPassword module adds a new validation for Devise Models. No modifications to routes or controllers needed. Simply add :pwned_password to the list of included modules in your devise module, and all new registrations will be blocked if they use a password in this dataset haveibeenpwned.com/Passwords.

Attributes

pwned_count[W]

Public Instance Methods

password_pwned?(password) click to toggle source

Returns true if password is present in the PwnedPasswords dataset

# File lib/devise/pwned_password/model.rb, line 46
      def password_pwned?(password)
puts %(pwned_count=#{(pwned_count).inspect})
puts %(persisted?=#{(persisted?).inspect})
          puts %(self.class.min_password_matches_warn=#{(self.class.min_password_matches_warn).inspect})
          @pwned = @pwned_count >= (persisted? ? self.class.min_password_matches_warn || self.class.min_password_matches : self.class.min_password_matches)
          return @pwned
      end
pwned?() click to toggle source
# File lib/devise/pwned_password/model.rb, line 36
def pwned?
  @pwned ||= false
end
pwned_count() click to toggle source
# File lib/devise/pwned_password/model.rb, line 40
def pwned_count
  @pwned_count ||= 0
end

Private Instance Methods

not_pwned_password_warn() click to toggle source
# File lib/devise/pwned_password/model.rb, line 56
def not_pwned_password_warn
  # This deliberately fails silently on 500's etc. Most apps won't want to tie the ability to sign up users to the availability of a third-party API.
  if password_pwned?(password)
    errors.add(:password, :pwned_password, count: @pwned_count)
  end
end