Removed all references to commonPasswords & the data file. This api route can be deprecated in favor of the client-side secure call to the haveIBeenPwnd password API. Further the datafile contains no passwords that meet the minimum password criteria.

frontend/src/components/signup/UserInfoStep.tsx

@@ -8,7 +8,6 @@ import jsrp from "jsrp";
 import nacl from "tweetnacl";
 import { encodeBase64 } from "tweetnacl-util";
 
-import { useGetCommonPasswords } from "@app/hooks/api";
 import { completeAccountSignup } from "@app/hooks/api/auth/queries";
 import { fetchOrganizations } from "@app/hooks/api/organization/queries";
 import ProjectService from "@app/services/ProjectService";
@@ -47,7 +46,6 @@ type Errors = {
   specialChar?: string;
   repeatedChar?: string;
   isBeachedPassword?: string;
-  isCommonPassword?: string;
 };
 
 /**
@@ -76,7 +74,6 @@ export default function UserInfoStep({
   setAttributionSource,
   providerAuthToken
 }: UserInfoStepProps): JSX.Element {
-  const { data: commonPasswords } = useGetCommonPasswords();
   const [nameError, setNameError] = useState(false);
   const [organizationNameError, setOrganizationNameError] = useState(false);
 
@@ -105,7 +102,6 @@ export default function UserInfoStep({
 
     errorCheck = await checkPassword({
       password,
-      commonPasswords,
       setErrors
     });
 
@@ -272,11 +268,10 @@ export default function UserInfoStep({
         <div className="mt-2 flex max-h-60 w-1/4 w-full min-w-[20rem] flex-col items-center justify-center rounded-lg py-2 lg:w-1/6">
           <InputField
             label={t("section.password.password")}
-            onChangeHandler={(pass: string) => {
+            onChangeHandler={async (pass: string) => {
               setPassword(pass);
-              checkPassword({
+              await checkPassword({
                 password: pass,
-                commonPasswords,
                 setErrors
               });
             }}

frontend/src/components/utilities/checks/checkPassword.ts

@@ -9,12 +9,10 @@ type Errors = {
   specialChar?: string;
   repeatedChar?: string;
   isBreachedPassword?: string;
-  isCommonPassword?: string;
 };
 
 interface CheckPasswordParams {
   password: string;
-  commonPasswords: string[];
   setErrors: (value: Errors) => void;
 }
 
@@ -28,7 +26,6 @@ interface CheckPasswordParams {
  * - Contains at least 1 special character
  * - Does not contain 3 repeat, consecutive characters
  * - Is not in a database of breached passwords
- * - Is not in a list of common passwords
  *
  * The function returns whether or not the password [password]
  * passes the minimum requirements above. It sets errors on
@@ -38,11 +35,7 @@ interface CheckPasswordParams {
  * @param {String} obj.password - the password to check
  * @param {Function} obj.setErrors - set state function to set error object
  */
-const checkPassword = async ({
-  password,
-  commonPasswords,
-  setErrors
-}: CheckPasswordParams): Promise<boolean> => {
+const checkPassword = async ({ password, setErrors }: CheckPasswordParams): Promise<boolean> => {
   const errors: Errors = {};
 
   // tooShort
@@ -86,11 +79,6 @@ const checkPassword = async ({
       "The password you provided is in a list of passwords commonly used on other websites. Please try again with a stronger password.";
   }
 
-  // commonPassword
-  if (commonPasswords.includes(password)) {
-    errors.isCommonPassword = "No common passwords";
-  }
-
   setErrors(errors);
   return Object.keys(errors).length > 0;
 };