How to validate password strength with Devise in Ruby on Rails?

Question

I want to force a user to choose a strong password on registration.

I know, there are many jquery password strength meters out there, and I will most probably use one of them, too. But that does not really enforce anyone to choose a strong password. The registration form must also be useable without js enabled, so one could still potentially register with a weak password.

Accounts must be most secure, because if you are logged in, you can see data of other accounts, which I do not want exposed under any circumstances. So I want to go for maximum security here, therefore I think, it is most important to only allow strong passwords.

So,

How do I set and customize requirements for validating minimum password strength? Only thing I could find in the devise config file is password length. Is there another gem that I should use for this task?

aromero · Accepted Answer · 2013-01-21 00:49:06Z

14

You can use the Devise Security extension, where you can define a password regexp validation (among other things) and enforce the password strength you want.

answered Jan 21, 2013 at 0:49

aromero

25.8k6 gold badges60 silver badges79 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Conkerchen Over a year ago

Sounds good. I'll give it a try. Though, I haven't seen the regex syntax used in the config file before. (?=...) I see what it does, but I would appreciate a little explanation, what the ?'s mean.

Martin Tournoij Over a year ago

IMHO these tests are too naive; it just wants a number & capital letter. A very long password with no numbers is still secure, but Passw0rd (for example) is a piss poor password (yet still meets these requirements)

James Moore Over a year ago

@Carpetsmoker is right; trying to do password strength by matching regular expressions is an awful idea.

MatthewFord · Accepted Answer · 2014-01-20 14:44:43Z

9

I've recently released a devise gem which uses the zxcvbn library to reject weak passwords:

https://github.com/bitzesty/devise_zxcvbn

answered Jan 20, 2014 at 14:44

MatthewFord

2,9262 gold badges21 silver badges32 bronze badges

3 Comments

James Moore Over a year ago

Be warned that this ends up using ExecJS - that's a surprising dependency.

MatthewFord Over a year ago

@jamesmoore this was needed as the pure Ruby version of the zxcvbn algorithm wasn't returning the same results as the JS version, we switched so that we could get the same results on the front and the backend.

James Moore Over a year ago

Interesting - definitely a design tradeoff here. I'd much rather have no js dependency and get slightly different results (and just do it all on the server, so client-side results would be irrelevant), but it makes sense that some people need the opposite.

Dave Powers · Accepted Answer · 2023-12-03 04:40:07Z

2

As of this writing (2018), I'd suggest folks consider the newer Devise Security fork before settling on the previously recommended Devise Security extension gem (stale as of v0.10.0 March 2016).

edited Dec 3, 2023 at 4:40

Dave Powers

2,4332 gold badges38 silver badges39 bronze badges

answered Feb 15, 2018 at 20:16

aschyiel

5876 silver badges9 bronze badges

Collectives™ on Stack Overflow

How to validate password strength with Devise in Ruby on Rails?

3 Answers 3

3 Comments

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related