Reject passwords containing user's personal info - #910

Open

iamtanuj18 wants to merge 13 commits into

devfrom

902-reject-pii-in-passwords

Commits on Jul 31, 2026

Add PII context param to checkPasswordStrength
iamtanuj18
committed
dc1b3c4
Add unit tests for checkPasswordStrength PII rejection
iamtanuj18
committed
9bbe478
Wire PII context through auth register endpoints
iamtanuj18
committed
02d062b
Wire PII context through password reset endpoint
iamtanuj18
committed
e64f2f9
Update tests to use passwords that don't collide with placeholder PII
iamtanuj18
committed
b4cd065
Update test seed placeholders and add PII rejection integration test
iamtanuj18
committed
cc2ea36
Update client forms to pass PII context to password check
iamtanuj18
committed
29880f5
Add cypress tests for PII rejection and use robust integration test password
iamtanuj18
committed
c54abfb
Raise PII token length threshold from 3 to 4 characters
iamtanuj18
committed
9ebbda0
Verify PII rejection via response status code in admin reset cypress test
iamtanuj18
committed
7db4f08
Add STRONG_TEST_PASSWORD constant and use it in Auth integration tests
iamtanuj18
committed
b13656f
Use STRONG_TEST_PASSWORD for participant register test to avoid PII collision
iamtanuj18
committed
c95866d
Target the underlying input in reg-first clear() call
iamtanuj18
committed
4865185