Groups in regex to validate password

Iterate the string, count the used characters per group and compare against your threshlds.

In a single regex would not it be possible? If so, would you have an example?

Like @NobbZ pointed out, using a regular expression is not ideal in this situation. It will obfuscate what you’re actually doing, might introduce obscure bugs and you won’t be able to give meaningful error messages.

Okay, I’ll implement it cleaner, anyway I wanted to explore more regex in Elixir, but thanks.

Here’s an implementation that doesn’t use regex, but it’s kind of ugly:

defmodule PasswordValidator do

  @valid_upper 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
  @valid_lower 'abcdefghijklmnopqrstuvwxyz'
  @valid_num '0123456789'

  def validate(pass) do
    chars =
      pass
      |> String.to_charlist()

    valid_length?(chars) and has_valid_chars?(chars) and has_required_chars?(chars)
  end

  defp valid_length?(chars) when is_list(chars) do
    length(chars) >= 6 and length(chars) <= 32
  end

  defp has_valid_chars?(chars) when is_list(chars) do
    Enum.all?(chars, &validate_char/1)
  end

  defp has_required_chars?(chars) when is_list(chars) do
    [&has_upper/1, &has_lower/1, &has_num/1]
    |> Enum.all?(&Enum.any?(chars, &1))
  end

  defp validate_char(char) do
    has_upper(char) or has_lower(char) or has_num(char)
  end

  defp has_upper(char) do
    char in @valid_upper
  end

  defp has_lower(char) do
    char in @valid_lower
  end

  defp has_num(char) do
    char in @valid_num
  end
end

Cool guy, thanks a lot

Or using my ExSpirit parsing library (untested but should be close enough:

defmodule PasswordValidator do
  use ExSpirit.Parser, text: true

  def validate(pass) do
    case parse(pass, valid_chars()) do
      %{error: nil, rest: ""} -> :ok
      %{error: nil} -> {:error, "Password is too long, keep it below 32 characters"}
      %{error: error} -> {:error, "Password must be between 6-32 characters and only alpha-
numeric, failure message:  #{Exception.message(error}"}
    end
  end

  defrule valid_char(char([?A..?Z, ?a..?z, ?0..?9]))

  defrule valid_chars(repeat(valid_char(), 6, 32)
end

Or so.

@ajoao or anyone else interested in this. Partially inspired by this thread (and the fact that there didn’t appear to be any password validators or checkers on hex) I’ve created a simple password validator library:

The original requirements would look like this with PasswordValidator:

opts = [
  length: [min: 6, max: 32],
  character_set: [
    lower_case: 1,  # at least one lower case letter
    upper_case: 1,  # at least one capital letter
    numbers: 1,  # at least one numbers
    special: [0, 0],  # no special characters allowed
  ]
]

changeset
|> PasswordValidator.validate(:password, opts)

Please feel free to check it out and give me any feedback (including on the code structure). I’ll probably try to do some sort of larger forum post in the near future but wanted to mention it here first.

Cool.

You could also replace the functionality of this password strength checker. ^.^

don’t really do that ^.^;

Yeah that would be a great next step!

But actually that led me to zxcvbn which is an entropy-based checker. That would be interesting to tackle and is currently missing an Elixir implementation. Also I am agreed that validating based on types of characters is not very useful (but I really just wanted to try my hand at a library).