3 ms·
Hi, I'm your product manager. I'd like you to create a login page where a user can log in using their email address and a password. We want our users to be ma
by jawns 9y ago
Hi, I'm your product manager.
I'd like you to create a login page where a user can log in using their email address and a password.
We want our users to be made to feel as if we take security seriously, so let's use the following secure password requirements that I picked up from a blog post:
* Password must be AT LEAST 6 characters (but no more than 12, because who's going to remember more than 12 characters?)
* There must be at least one number.
* There most be at least one uppercase and at least one lowercase letter.
* There should be at least one special character, but not just any special character, because we don't want things to get crazy. Only these five: &$+#%
Okay, can you code that up for me?
Wait, it'll take how long?
Well, yes, I understand that you not only need to build in the validation logic but also need to build little error messages to let the user know what they've done wrong if their password doesn't meet all the requirements, plus allow time for writing tests, getting UX's rubberstamp, etc.
But I kind of need this by tomorrow afternoon. Is there anything we can consider out of scope?
- bolololo1 9y agopretty easy with Reactive Angular Forms.
- rogual 9y agoMy favourite are the ones where you're not allowed to use “the portion of your email address before the @” in your password. My email address is r@foon.uk. Fun times :D
- gear54rus 9y agoDidn't you bring this on yourself? I hate any requirements for passwords but why go for cornercase email?
- gnu8 9y agoNow you’re blaming the user though. The user isn’t wrong for having a valid email address.
- gear54rus 9y agoThere are degrees of valid. There is RFC valid and then there is 'common sense' valid (there are degrees of common too). Forcing yourself into barely common valid but RFC valid is user's fault.
- uranusjr 9y agoI fail to see how this email address does not qualify as common sense valid though. Maybe it’s just me being surrounded by tech-saavy people, but I have a bunch of friends using emails like i@domain.com and me@name.com.
- gnu8 9y agoValid is a binary condition. Either an address is valid and you will be able to send mail to it, or it is not. That is usually the sole reason for validating an email address. If a bug in the validation logic causes an unusual email address to invalidate then the code is definitely wrong, not the user. If the PM specifies a requirement to filter out email addresses with a single character before the @ sign, then that's a different thing. Maybe there is a business requirement to filter out people who own a domain and give themselves a single character email address? In that case it should be explicitly written into the validation logic and not done as a side effect of sloppy coding.
- lps41 9y agoI don't see this as cornercase. I see this as going for easiest possible email address to type, and easiest possible email address to verbally communicate to someone.
- WhoIsSatoshi 9y agosounds more like product manager here - unless roles blend where you're at
- sametmax 9y ago2h with django :)