update/password security

package-lock.json

@@ -11,6 +11,7 @@
       "dependencies": {
         "@google/genai": "^0.14.0",
         "bcrypt": "^5.1.1",
+        "check-password-strength": "^3.0.0",
         "connect-mongo": "^5.1.0",
         "crypto": "^1.0.1",
         "dotenv": "^16.5.0",
@@ -20,7 +21,7 @@
         "joi": "^17.13.3",
         "mongodb": "^6.16.0",
         "nodemailer": "^7.0.3",
-        "sweetalert2": "^11.21.0"
+        "sweetalert2": "^11.6.13"
       },
       "devDependencies": {
         "nodemon": "^3.1.10"
@@ -446,6 +447,15 @@
         "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
+    "node_modules/check-password-strength": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/check-password-strength/-/check-password-strength-3.0.0.tgz",
+      "integrity": "sha512-XIBvWpb7/RI2DO05tMixE4WbFFvEC7ls/jr1VSrWgXvlCmdiH2fsdkixG0cNGs1uIXwoSqJ75T3s9H/TlJV6Cw==",
+      "license": "MIT",
+      "dependencies": {
+        "escape-string-regexp": "^5.0.0"
+      }
+    },
     "node_modules/chokidar": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
@@ -769,6 +779,18 @@
       "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "license": "MIT"
     },
+    "node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/etag": {
       "version": "1.8.1",
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
@@ -2430,9 +2452,10 @@
       }
     },
     "node_modules/sweetalert2": {
-      "version": "11.21.0",
-      "resolved": "https://registry.npmjs.org/sweetalert2/-/sweetalert2-11.21.0.tgz",
-      "integrity": "sha512-fiEK7SqRY/QD/wC2uqEHlfYGZ7qe2UcyQbJpbpj4YRVqplBgcI+euPZLZL+evLINcvbtXmL1SFUdZHKqBHGAAQ==",
+      "version": "11.6.13",
+      "resolved": "https://registry.npmjs.org/sweetalert2/-/sweetalert2-11.6.13.tgz",
+      "integrity": "sha512-n5yVF0FNx1lm4XzpPyb1HIaiptzODfVyeCzmB809tpK+1bPdoKoevKOxYjrtId75DV7xuIp4r6cjn8xUAB8dPQ==",
+      "license": "MIT",
       "funding": {
         "type": "individual",
         "url": "https://github.com/sponsors/limonte"

package.json

@@ -20,6 +20,7 @@
   "dependencies": {
     "@google/genai": "^0.14.0",
     "bcrypt": "^5.1.1",
+    "check-password-strength": "^3.0.0",
     "connect-mongo": "^5.1.0",
     "crypto": "^1.0.1",
     "dotenv": "^16.5.0",
@@ -29,7 +30,7 @@
     "joi": "^17.13.3",
     "mongodb": "^6.16.0",
     "nodemailer": "^7.0.3",
-    "sweetalert2": "^11.21.0"
+    "sweetalert2": "^11.6.13"
   },
   "devDependencies": {
     "nodemon": "^3.1.10"

src/auth/authentication.js

@@ -1,5 +1,5 @@
+const { passwordStrength } = require("check-password-strength");
 const status = require("../util/statuses");
-const session = require("express-session");
 const bcrypt = require('bcrypt');
 const joi = require("joi");
 const salt = 12;
@@ -99,6 +99,14 @@ module.exports = (users) => {
             return res.redirect("/signup");
         }
 
+        let strength = passwordStrength(req.body.password);
+
+        if (strength.id < 2) {
+            req.session.errMessage = `Password ${strength.value}`;
+            res.status(status.BadRequest);
+            return res.redirect("/signup");
+        }
+
         let hashedPassword = await bcrypt.hashSync(req.body.password, salt);
 
         users.insertOne({

src/views/profile.ejs

@@ -62,7 +62,7 @@
             <input id="name" disabled type="text" name="name" value="<%= user.name %>" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">
 
             <label for="password" class="block text-sm font-medium text-gray-700">New password</label>
-            <input id="password" disabled type="password" name="password" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">
+            <input id="password" disabled type="password" name="password" minlength="8" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">
 
             <label for="repassword" class="block text-sm font-medium text-gray-700">Confirm new password</label>
             <input id="repassword" disabled type="password" name="repassword" class="mt-1 block w-full px-3 py-2 border border-gray-300 rounded-md shadow-sm focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm disabled:border-gray-200 disabled:bg-gray-50 disabled:text-gray-500 disabled:shadow-none">

src/views/signup.ejs

@@ -23,7 +23,7 @@
                             <label for="password" class="block text-base mb-2">Password</label>
                             <input type="password" id="password" name="password"
                                 class="border focus:border-gray-600 w-full rounded-md text-base px-2 py-1 focus:outline-none focus:ring-0 "
-                                placeholder="Enter Password" />
+                                placeholder="Enter Password" minlength="8"/>
                             <label for="password" class="block text-base mb-2 mt-3">Re-type Password</label>
                             <input type="password" id="repassword" name="repassword"
                                 class="border focus:border-gray-600 w-full rounded-md text-base px-2 py-1 focus:outline-none focus:ring-0 "