Enable auth validate passwords #5696
Conversation
Define some simple validators to use when creating a new user or changing the password. https://docs.djangoproject.com/en/1.11/topics/auth/passwords/#module-django.contrib.auth.password_validation
| 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', | ||
| }, | ||
| { | ||
| 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', |
There was a problem hiding this comment.
I really dislike these defaults in dev. I think these should likely only be prod settings, or disabled explicitly in dev settings.
|
I'm in favor of these settings being present in the base settings file as they are in this PR. This helps others who take our code to do the right thing as well as ensuring that all the different instances we control (community site, corporate site, etc.) have sound security defaults. I can understand @ericholscher's position and we could also set |
I like this. I will update the PR for this. |
Define some simple validators to use when creating a new user or
changing the password.
https://docs.djangoproject.com/en/1.11/topics/auth/passwords/#module-django.contrib.auth.password_validation
Closes #5551