update/password security

src/auth/authentication.js

@@ -1,5 +1,5 @@
+const { passwordStrength } = require("check-password-strength");
 const status = require("../util/statuses");
-const session = require("express-session");
 const bcrypt = require('bcrypt');
 const joi = require("joi");
 const salt = 12;
@@ -99,6 +99,14 @@ module.exports = (users) => {
             return res.redirect("/signup");
         }
 
+        let strength = passwordStrength(req.body.password);
+
+        if (strength.id < 2) {
+            req.session.errMessage = `Password ${strength.value}`;
+            res.status(status.BadRequest);
+            return res.redirect("/signup");
+        }
+
         let hashedPassword = await bcrypt.hashSync(req.body.password, salt);
 
         users.insertOne({

src/views/profile.ejs

@@ -62,7 +62,7 @@
             <input id="name" disabled type="text" name="name" value="<%= user.name %>" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">
 
             <label for="password" class="block text-sm font-medium text-gray-700">New password</label>
-            <input id="password" disabled type="password" name="password" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">
+            <input id="password" disabled type="password" name="password" minlength="8" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">
 
             <label for="repassword" class="block text-sm font-medium text-gray-700">Confirm new password</label>
             <input id="repassword" disabled type="password" name="repassword" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">

src/views/signup.ejs

@@ -23,7 +23,7 @@
                             <label for="password" class="block text-base mb-2">Password</label>
                             <input type="password" id="password" name="password"
                                 class="border focus:border-gray-600 w-full rounded-md text-base px-2 py-1 focus:outline-none focus:ring-0 "
-                                placeholder="Enter Password" />
+                                placeholder="Enter Password" minlength="8"/>
                             <label for="password" class="block text-base mb-2 mt-3">Re-type Password</label>
                             <input type="password" id="repassword" name="repassword"
                                 class="border focus:border-gray-600 w-full rounded-md text-base px-2 py-1 focus:outline-none focus:ring-0 "