spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Bug] Registration password does not enforce uppercase/lowercase/special-character complexity #257

New Issue
Closed
opened 2026-06-25 16:25:23 +00:00 by spikerj · 1 comment
spikerj commented 2026-06-25 16:25:23 +00:00
Owner
Copy Link
Copy Source

Severity

Medium — weak passwords can be created during signup; the UX also doesn't tell users the complexity rules they expect (capital, lowercase, special character).

Area

Registration stepper — Step 3 (Password & Preferences), password field validation.

Bug

The password form control only validates required and minLength(8):

password: ["", [Validators.required, Validators.minLength(8)]],

There is no enforcement of character complexity, so a password like longenough (all lowercase, no capital, no special character) is accepted as valid. Users are accustomed to being told a password must contain a capital letter, a lowercase letter, and a special character — none of which is currently required.

Note: the component already measures these criteria in getPasswordStrength() (lower/upper/digit/special), but that only drives the strength badge — it does not block submission.

Steps to reproduce

  1. Open the "Join SpikerSoft" registration flow and go to the password step.
  2. Enter longenough as the password (and confirm it).
  3. Observe the form treats the password as valid (no complexity error).

Expected

The password must contain at least one uppercase letter, one lowercase letter, and one special character (in addition to the existing 8-character minimum). Unmet requirements should be shown as clear, localized validation errors and should block proceeding.

Pointers

  • spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/registration-stepper.component.ts — passwordForm password validators.
  • spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/registration-stepper.component.html — password mat-error messages.
  • i18n: add registration.password.requirement* keys to assets/i18n/en.json / es.json.
## Severity Medium — weak passwords can be created during signup; the UX also doesn't tell users the complexity rules they expect (capital, lowercase, special character). ## Area Registration stepper — Step 3 (Password & Preferences), password field validation. ## Bug The password form control only validates `required` and `minLength(8)`: ```ts password: ["", [Validators.required, Validators.minLength(8)]], ``` There is no enforcement of character complexity, so a password like `longenough` (all lowercase, no capital, no special character) is accepted as valid. Users are accustomed to being told a password must contain a capital letter, a lowercase letter, and a special character — none of which is currently required. Note: the component already *measures* these criteria in `getPasswordStrength()` (lower/upper/digit/special), but that only drives the strength badge — it does not block submission. ### Steps to reproduce 1. Open the "Join SpikerSoft" registration flow and go to the password step. 2. Enter `longenough` as the password (and confirm it). 3. Observe the form treats the password as valid (no complexity error). ### Expected The password must contain at least one uppercase letter, one lowercase letter, and one special character (in addition to the existing 8-character minimum). Unmet requirements should be shown as clear, localized validation errors and should block proceeding. ## Pointers - `spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/registration-stepper.component.ts` — `passwordForm` password validators. - `spikersoft-angular/projects/spikersoft/src/app/_components/registration-stepper/registration-stepper.component.html` — password `mat-error` messages. - i18n: add `registration.password.requirement*` keys to `assets/i18n/en.json` / `es.json`.
spikerj added the bug label 2026-06-25 16:25:23 +00:00
spikerj commented 2026-06-26 15:08:30 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-angular PR #76 (merged to master). Added a password complexity validator requiring at least one uppercase letter, one lowercase letter, and one special character (length still handled by minLength), each surfaced as its own targeted, translated error message. Closing.

Resolved in spikersoft-angular PR #76 (merged to `master`). Added a password complexity validator requiring at least one uppercase letter, one lowercase letter, and one special character (length still handled by minLength), each surfaced as its own targeted, translated error message. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#257