Weak Password Controls

// Node.js/Express + bcrypt - SECURE password controls

const bcrypt = require('bcrypt');

// Common password list (top 10k most common passwords)
const COMMON_PASSWORDS = new Set([
  'password', '123456', '12345678', 'qwerty', 'abc123',
  'monkey', '1234567', 'letmein', 'trustno1', 'dragon',
  'baseball', '111111', 'iloveyou', 'master', 'sunshine',
  // ... load from file or API
]);

function validatePassword(password) {
  const errors = [];
  
  // Minimum length: 12 characters
  if (password.length < 12) {
    errors.push('Password must be at least 12 characters long');
  }
  
  // Maximum length to prevent DoS
  if (password.length > 128) {
    errors.push('Password must be less than 128 characters');
  }
  
  // Check against common passwords
  if (COMMON_PASSWORDS.has(password.toLowerCase())) {
    errors.push('This password is too common. Please choose a different one.');
  }
  
  // Optional: Check for sequential patterns
  if (/^(\d)\1+$/.test(password) || /^(abc|123|qwe)/i.test(password)) {
    errors.push('Password contains sequential patterns');
  }
  
  return errors;
}

// Optional: Check against HaveIBeenPwned API (k-anonymity)
async function checkBreachedPassword(password) {
  const crypto = require('crypto');
  const hash = crypto.createHash('sha1').update(password).digest('hex').toUpperCase();
  const prefix = hash.substring(0, 5);
  const suffix = hash.substring(5);
  
  const response = await fetch(`https://api.pwnedpasswords.com/range/${prefix}`);
  const text = await response.text();
  
  return text.includes(suffix);
}

app.post('/api/register', async (req, res) => {
  try {
    const { email, password } = req.body;
    
    // SECURE: Validate password strength
    const validationErrors = validatePassword(password);
    if (validationErrors.length > 0) {
      return res.status(400).json({ errors: validationErrors });
    }
    
    // SECURE: Check if password has been breached
    const isBreached = await checkBreachedPassword(password);
    if (isBreached) {
      return res.status(400).json({
        error: 'This password has been exposed in a data breach. Please choose a different password.'
      });
    }
    
    const existingUser = await User.findOne({ email });
    if (existingUser) {
      return res.status(400).json({ error: 'Email already registered' });
    }
    
    // SECURE: Use strong bcrypt cost (12 rounds = ~250ms)
    const saltRounds = 12;
    const hashedPassword = await bcrypt.hash(password, saltRounds);
    
    const newUser = await User.create({
      email,
      password: hashedPassword
    });
    
    res.json({ message: 'Registration successful', userId: newUser._id });
  } catch (err) {
    res.status(500).json({ error: 'Server error' });
  }
});

app.post('/api/change-password', authenticateToken, async (req, res) => {
  const { currentPassword, newPassword } = req.body;
  const userId = req.user.id;
  
  const user = await User.findById(userId);
  const validCurrent = await bcrypt.compare(currentPassword, user.password);
  
  if (!validCurrent) {
    return res.status(401).json({ error: 'Current password incorrect' });
  }
  
  // SECURE: Validate new password
  const validationErrors = validatePassword(newPassword);
  if (validationErrors.length > 0) {
    return res.status(400).json({ errors: validationErrors });
  }
  
  // Check breach status
  const isBreached = await checkBreachedPassword(newPassword);
  if (isBreached) {
    return res.status(400).json({
      error: 'This password has been exposed in a data breach.'
    });
  }
  
  const hashedNew = await bcrypt.hash(newPassword, 12);
  await User.findByIdAndUpdate(userId, { password: hashedNew });
  
  res.json({ message: 'Password changed successfully' });
});