3 ms·
Do your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this passwor
by mabbo 10y ago
Do your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this password was already used, etc).
- whiskeySix 10y agoany clientside validation can easily be bypassed using something like fiddler.
- FabHK 10y agoPassword strength checking is (properly understood, in my view) providing help to the user, not enforcing some silly and annoying "password validation" rules.