Table of Contents

Purpose

...

• has at least 12 characters long;
• contains both upper- and lowercase letters, numbers, and special charactersletter and numbers (required), special characters (optional)

Must be controlled by regular expression: ^(?=.*[a-zа-яёїієґ])(?=.*[A-ZА-ЯЁЇIЄҐ])(?=.*\d){12}

1. Validate upper, lowercase letter and numbers

In case of error - return 422 error (message: "Password doest does not meet complexity requirements")

{:error, [{%{
        description: "Password doestdoes not meet complexity requirements",
        params: [],
        rule: :invalid
      }, "$.password"}]}

2. Validate password length (at least 12 characters long)

In case of error - return 422 error (message: "Password must be at least 12 characters long")

{:error, [{%{
        description: "Password must be at least 12 characters long",
        params: [],
        rule: :invalid
      }, "$.password"}]}

• Add to mithril.users password_expiresset_at = now()+config.password_lifetime

2. Save passwords history

When $.decrypted_hash<>mihril.users.password (the user set up a new password)  -  add the row to mithril.user_passwords_history

3. Not allow to use recently used passwords

...

{:error, [{%{
        description: "This password has been used recently. Try another one",
        params: [],
        rule: :invalid
      }, "$.password"}]}

4

...

.

...

• show message 'Your passwords expires soon. Please, change it to the new one.'

...

Expire Passwords

Fetch Once a day fetch all records from mithril.users where now()>=mithril.users.password_expiresset_at+config.password_lifetime

• set expires_at=now() for all tokens where tokens.name='refresh_token' and tokens.user_id=$user.iddon (--and tokens.name='refresh_token')

Don't send access_token in response on {{host}}/oauth/tokens  until the password will be changed. Show the message Error 401 "The password

...

expired".