Identity UI Password validation has string length is hardcoded to 6
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Describe the bug
In the Microsoft.AspNetCore.Identity.UI package, the StringLength validation for the password in registration form is [hardcoded to 6](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/Register.cshtml.cs).
So changing the `PasswordOptions.RequiredLength` property in Startup.cs has no effect on the validation.
And you can look in [Source Code](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/Register.cshtml.cs) that `Password` property has the following attributes:
```csharp
[Required]
[StringLength(100, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.", MinimumLength = 6)]
[DataType(DataType.Password)]
[Display(Name = "Password")]
public string Password { get; set; }
```
Which is as you can see the length is hardcoded.
The [Reset Password](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/ResetPassword.cshtml.cs) and [Change Password](https://github.com/dotnet/aspnetcore/blob/v3.1.8/src/Identity/UI/src/Areas/Identity/Pages/V4/Account/Manage/ChangePassword.cshtml.cs) also have the same hardcoded value.
### To Reproduce
1. Create a new Asp.NET Core Web Application with following options: WebApplication (Model-View-Controller) and Individual User Account calculator.
2. In startup.cs change identity options as follows:
```csharp
services.AddDefaultIdentity(options =>
{
options.SignIn.RequireConfirmedAccount = true;
options.Password.RequiredLength = 4; // This line is changing the default
}).AddEntityFrameworkStores();
```
3. Run the application, go the the Register Page, Enter a 4 letter password.
### Expected Output
Password of length 4 chars or more should be accepted to match the setting for `RequiredLength` property.
### Actual Output
Password validation fails and the validation message indicates minimum length is 6 characters.
### Exceptions (if any)
No exceptions are thrown
### Further technical details
- ASP.NET Core version: 3.1.8
- dotnet --info
```
.NET Core SDK (reflecting any global.json):
Version: 3.1.402
Commit: 9b5de826fd
Runtime Environment:
OS Name: Windows
OS Version: 10.0.19041
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\3.1.402\
Host (useful for support):
Version: 3.1.8
Commit: 9c1330dedd
.NET Core SDKs installed:
3.1.401 [C:\Program Files\dotnet\sdk]
3.1.402 [C:\Program Files\dotnet\sdk]
.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.1.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
To install additional .NET Core runtimes or SDKs:
https://aka.ms/dotnet-download
```
- Visual Studio 2019 Version 16.7.3
Contributor guide
Assessment
This issue has not been assessed yet.