hclarsen / devise-uncommon_password Goto Github PK

devise >= 3.5, < 4.9

Currently it depends on rails (< 5.2, >= 4.2).

If you find that 100 passwords is not enough, here's my go-to password list:
https://github.com/danielmiessler/SecLists/tree/master/Passwords

I'm happy to create a PR for this, mainly checking if you are interested in the idea/think it makes sense for this gem.

I would like to add a configuration to uncommon_password to call

https://haveibeenpwned.com/API/v2#PwnedPasswords

This would be opt in, as people already using the gem may not want hashed user passwords being sent to a third party.

Hi!
Rails 7.1 was released on October 5.
Could you update the gem to support this version?
Thanks!

Rails 7.1: Dockerfiles, BYO Authentication, More Async Queries, and more!

Is this gem still maintained?

If so, it would be great if you can allow localization of the error message.

This block

Should probably just have something like:

errors.add(:password, :common)

Which will just allow us to define the message in a localization file:

# config/locales/activerecord.en.yml
en:
  activerecord: 
    errors:
      models:
        user:
          attributes:
            password:
              common: "must not be a commonly used password"

I'm looking to potentially use this gem, but according to the gemspec and rubygems, Devise 4.8 isn't supported, so I'd have to downgrade.

Is it possible to add support for this? I'm not sure if this is trivial or difficult, but this version has been out for about 6 months now.