5 ms·
hahaha you're right! we've just setup the ^[a-zA-Z0-9_.-]+$ regex for both username and password. Thanks for the pen-testing
by thegurus 7y ago
hahaha you're right! we've just setup the ^[a-zA-Z0-9_.-]+$ regex for both username and password. Thanks for the pen-testing
- tomsmeding 7y agoDo you really want that regex for passwords also? Am I not allowed to put interesting characters in my password?
- bonyt 7y agoNot sure this is ideal either, it rejected the first password my password manager generated. Password should probably just be anything other than all whitespace, no? Maybe a length requirement.
- thegurus 7y agoSorry guys, do you like ^[A-Za-z0-9@#$%^&+=]+$ for your passwords?
- BlackLotus89 7y agoYou should not regex check your passwords at all. Just check !="" and maybe check the length There is no reason why you should limit symbols for passwords.
- jnbiche 7y agoThis times 1000. Why would you regex check your password? Check for empty string and length and be done with it.
- thegurus 7y agoYou are right. Django default auth backend handles this perfectly, but we wanted that functionality of login + signup in the same form, and that signup autofill in case login fail, so made our custom auth views and screw up some things (like username and password validation and going back to previous page after login)