Documentation
¶
Overview ¶
Package passwords provides bcrypt password hashing and strength validation.
Security:
- bcrypt with cost factor 12 (tunable)
- Constant-time comparison (built into bcrypt)
- No plaintext passwords ever stored or logged
Index ¶
Constants ¶
const ( // MinPasswordLength is the minimum acceptable password length. MinPasswordLength = 8 // MaxPasswordLength is bcrypt's maximum password byte length. MaxPasswordLength = 72 )
const ProductionBcryptCost = 12
ProductionBcryptCost is the bcrypt work factor used in production (≈250 ms on modern hardware). Lowering it is a security regression; the strength_security_test enforces it.
Variables ¶
This section is empty.
Functions ¶
func Hash ¶
Hash hashes a plaintext password using bcrypt with cost 12. The returned string is suitable for storage (e.g. "$2a$12$...").
func SetCostForTests ¶ added in v0.6.5
func SetCostForTests(cost int) (restore func())
SetCostForTests overrides the bcrypt cost factor for the duration of a test binary. Call ONLY from TestMain (before any tests run) or from a single test that immediately defers the returned restore func. It is not safe for concurrent use and must never be called from production code. Returns a restore func that resets the original cost.
func ValidateStrength ¶
ValidateStrength validates password strength against the global default policy and returns a list of issues. An empty slice means the password meets all requirements.
func ValidateStrengthWithPolicy ¶ added in v1.7.4
func ValidateStrengthWithPolicy(password string, policy StrengthPolicy) []string
ValidateStrengthWithPolicy validates password strength against a per-tenant StrengthPolicy and returns a list of issues. An empty slice means the password meets all requirements. The policy can only tighten the global rules (see StrengthPolicy).
Types ¶
type StrengthPolicy ¶ added in v1.7.4
type StrengthPolicy struct {
// MinLength is the tenant's minimum length. 0 means "use the global
// MinPasswordLength"; any value below MinPasswordLength is treated as
// MinPasswordLength (tenants tighten, never loosen).
MinLength int
}
StrengthPolicy tunes ValidateStrengthWithPolicy for a single caller — typically a tenant's per-org password rules. The zero value is the global default: MinLength falls back to MinPasswordLength and the four character classes (upper/lower/digit/special) are required. A tenant may only ever tighten the global baseline, never loosen it: MinLength below MinPasswordLength is clamped up to MinPasswordLength, and the global character-class rules are always enforced.
Source Files