dotnet / dotnet/aspnetcore

Identity UI Password validation has string length is hardcoded to 6

Open
#25,788 8 comments 0 reactions 0 assignees View on GitHub
affected-few area-identity enhancement severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Describe the bug
In the Microsoft.AspNetCore.Identity.UI package, the StringLength validation for the password in registration form is [hardcoded to 6](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/Register.cshtml.cs).
So changing the `PasswordOptions.RequiredLength` property in Startup.cs has no effect on the validation.

And you can look in [Source Code](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/Register.cshtml.cs) that `Password` property has the following attributes:

```csharp
[Required]
[StringLength(100, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.", MinimumLength = 6)]
[DataType(DataType.Password)]
[Display(Name = "Password")]
public string Password { get; set; }
```
Which is as you can see the length is hardcoded.

The [Reset Password](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/ResetPassword.cshtml.cs) and [Change Password](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/Manage/ChangePassword.cshtml.cs) also have the same hardcoded value.

### To Reproduce
1. Create a new Asp.NET Core Web Application with following options: WebApplication (Model-View-Controller) and Individual User Account calculator.
2. In startup.cs change identity options as follows:
```csharp
services.AddDefaultIdentity(options =>
{
options.SignIn.RequireConfirmedAccount = true;
options.Password.RequiredLength = 4; // This line is changing the default
}).AddEntityFrameworkStores();
```
3. Run the application, go the the Register Page, Enter a 4 letter password.

### Expected Output
Password of length 4 chars or more should be accepted to match the setting for `RequiredLength` property.
### Actual Output
Password validation fails and the validation message indicates minimum length is 6 characters.

### Exceptions (if any)
No exceptions are thrown

### Further technical details
- ASP.NET Core version: 3.1.8
- dotnet --info
```
.NET Core SDK (reflecting any global.json):
Version: 3.1.402
Commit: 9b5de826fd

Runtime Environment:
OS Name: Windows
OS Version: 10.0.19041
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\3.1.402\

Host (useful for support):
Version: 3.1.8
Commit: 9c1330dedd

.NET Core SDKs installed:
3.1.401 [C:\Program Files\dotnet\sdk]
3.1.402 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.1.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

To install additional .NET Core runtimes or SDKs:
https://aka.ms/dotnet-download
```

- Visual Studio 2019 Version 16.7.3

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.