awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added comments to explain breach passwords API

Browse Source
This commit is contained in:
Joel Biddle
2023-08-22 18:14:03 +10:00
parent e288402ec4
commit c5ae402787
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
frontend/src/components/utilities/checks/checkIsPasswordBreached.ts
View File

@@ -2,7 +2,15 @@ import axios from "axios";
import crypto from "crypto"; // added types from @types/node
export const checkIsPasswordBreached = async (password: string) => {
const dataBreachCheckAPIBaseURL = "https://api.pwnedpasswords.com/range/";
// see API details here: https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange
// in short, the pending password is hashed (SHA-1), fist 5 chars are sliced and compared against a ranged hash table
// if there is a match, that password has been involved in a password breach and should not be accepted
// the database consists of ~700 mln breached passwords and is continuously being updated including with data from the FBI & the UK's NCA
// https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live/
const dataBreachCheckAPIBaseURL = "https://api.pwnedpasswords.com/range/"; // added to CSP
try {
const textEncoder = new TextEncoder();
const encodedPwd = textEncoder.encode(password);
@@ -13,24 +21,21 @@ export const checkIsPasswordBreached = async (password: string) => {
.join("")
.toUpperCase();
// Ensure that ONLY the first five SHA-1 hash chars are sent over HTTPS
const response = await axios.get(`${dataBreachCheckAPIBaseURL}${hashedPwd.slice(0, 5)}`);
console.log("response:", response); // delete later!!!
const responseData = response.data.toUpperCase();
console.log("responseData:", responseData); // delete later!!!
const isBreachedPassword = responseData.includes(hashedPwd.slice(5, 40));
console.log("isBreachedPassword:", isBreachedPassword); // delete later!!!
// Clear the hashed password from memory
// Clear the hashed password from memory (good practice)
const zeroBuffer = new Uint8Array(encodedPwd.length);
encodedPwd.set(zeroBuffer);
return isBreachedPassword;
return isBreachedPassword; // boolean
} catch (err: any) {
if (axios.isAxiosError(err) && err.response && err.response.status === 429) {
console.error("Received a 429 response from the Pwnd Passwords API");
// Handle the 429 error here
// Handle the 429 error here (not 100% sure what the rate limits are for the password API)
// an error here should not cause a fail of setting/resetting/changing the password
} else {
console.error(err);
}