KRYSTALM7 opened a new issue, #138:
URL: https://github.com/apache/fineract-loan-origination/issues/138
## Description
The LOS authentication flow lacks password strength validation for both
customer and staff registration. Weak passwords can be registered without any
rejection, increasing the risk of account compromise.
The parent Apache Fineract platform addressed a similar gap in its core
staff (`AppUser`) authentication in v1.11.0 (CVE-2025-23408). The LOS
has its own staff JWT registration flow that is separate from the core
Fineract user management, and currently has no equivalent validation.
Both the staff and customer registration paths in the LOS must enforce
consistent password strength rules.
## Proposed validation
The password validator should:
- Require a minimum length of 12 characters.
- Reject passwords present in a bundled blocklist of commonly used passwords.
- Reject passwords containing the user's username or email address
(case-insensitive).
- Return clear and actionable validation details.
- Ensure plaintext passwords are never logged.
- Apply the same validation consistently to customer and staff registration.
### Password policy note
The implementation should prioritize password length and a
common/compromised-password blocklist.
Current OWASP and NIST guidance does not recommend mandatory
upper/lowercase/digit/special-character composition rules for
user-chosen passwords. Longer passwords/passphrases and blocking commonly
used or compromised passwords are preferred.
> **Note on staff registration:** The LOS staff auth flow
(`StaffAuthController`
> / JWT registration) is distinct from Fineract core's `AppUser` management.
> The validation added here should mirror the intent of the CVE-2025-23408
> fix but be implemented within the LOS codebase rather than relying on the
> parent platform.
## Proposed files
### Create
- `PasswordValidator.java`
- `PasswordValidationResult.java`
- `common-passwords.txt`
- `PasswordValidatorTest.java`
### Modify
- `AuthController.java` (customer registration)
- Staff JWT registration endpoint (staff registration)
- Any shared authentication/service layer required to ensure both paths
use the validator.
## Example error response
```json
{
"error": "WEAK_PASSWORD",
"message": "Password does not meet security requirements",
"details": [
"Password must be at least 12 characters long",
"Password is too common"
]
}
```
The exact error format should follow the existing LOS error-handling
conventions.
## Acceptance Criteria
* [ ] Passwords shorter than 12 characters are rejected.
* [ ] Common/blocklisted passwords are rejected.
* [ ] Passwords containing the username are rejected.
* [ ] Passwords containing the email address are rejected.
* [ ] Customer registration enforces password validation.
* [ ] Staff JWT registration enforces password validation.
* [ ] Validation failures provide clear, actionable messages.
* [ ] Plaintext passwords are never logged.
* [ ] Unit tests cover all validation rules and relevant edge cases.
* [ ] The blocklist is loaded efficiently and is not parsed from disk
for every request.
* [ ] Password validation adds negligible overhead to registration requests.
## Security considerations
The validator must never persist or log plaintext passwords.
The common-password blocklist should be stored as a project resource and
loaded efficiently (e.g. into a `HashSet` at startup).
The parent Apache Fineract platform fixed CVE-2025-23408 (weak password
policy) in v1.11.0. The LOS staff JWT auth is a separate layer and must
independently enforce equivalent protections.
## References
* OWASP Authentication Cheat Sheet:
https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
* CVE-2025-23408 — Apache Fineract weak password policy (fixed in 1.11.0):
https://fineract.apache.org/security.html
* SecLists (common password wordlists):
https://github.com/danielmiessler/SecLists
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
