nswdpc / silverstripe-pwnage-hinter
Verify hashed passwords against HIBP
Installs: 3 789
Dependents: 1
Suggesters: 0
Security: 0
Stars: 1
Watchers: 4
Forks: 0
Open Issues: 0
Type:silverstripe-vendormodule
Requires
Requires (Dev)
- friendsofphp/php-cs-fixer: ^3
- phpunit/phpunit: ^9.5
This package is auto-updated.
Last update: 2024-03-26 04:55:24 UTC
README
This module allows verification of hashed passwords against the HIBP corpus.
For more information on how the Pwned Password API works, including how compromised password hashes are sent to the API, please read: https://haveibeenpwned.com/API/v3#PwnedPasswords
This module is under active development and should not be considered production-ready just yet
We welcome testing and feedback via the Github issue tracker
Background
This module uses MFlor/pwned to interface with the Password and Breach API.
In addition to password checking it can optionally check for breaches linked to a supplied email address, which requires an API key to be purchased from haveibeenpwned
From a Silverstripe perspective, the module:
- checks for pwned passwords and prohibits their use via a
PasswordValidator
extension - flag relevant records
- sends digest emails containing volume of pwned passwords
Configuration
The module comes with a default configuration that should get you up and running.
Read the configuration documentation for configuration instructions
Read the email documentation for information about email and templates
License
Documentation
Maintainers
Bugtracker
We welcome bug reports, pull requests and feature requests on the Github Issue tracker for this project.
Please review the code of conduct prior to opening a new issue.
Development and contribution
If you would like to make contributions to the module please ensure you raise a pull request and discuss with the module maintainers.
Please review the code of conduct prior to completing a pull request.