1"use strict";(self.webpackChunkblog=self.webpackChunkblog||[]).push([[1622],{4399:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>r,metadata:()=>s,toc:()=>l});var s=t(1347),i=t(4848),o=t(8453);const r={title:"ASP.NET Identity - Weakening password policies",tags:["ASP-NET-CORE","ASP-NET-IDENTITY","PASSWORD"],slug:"aspnet-identity-weakening-password-policies"},a="ASP.NET Identity: Weakening password policies",d={authorsImageUrls:[]},l=[{value:"Problem",id:"problem",level:2},{value:"Solution",id:"solution",level:2}];function c(e){const n={a:"a",code:"code",h2:"h2",img:"img",li:"li",p:"p",pre:"pre",ul:"ul",...(0,o.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{src:t(8130).A+"",width:"1280",height:"681"})}),"\n",(0,i.jsxs)(n.p,{children:["This is the second article in a series of articles about ASP.NET Core Identity.\nYou can find the first one ",(0,i.jsx)(n.a,{href:"/blog/add-extra-user-claims-aspnet-core-webapp",children:"here"}),"."]}),"\n",(0,i.jsx)(n.h2,{id:"problem",children:"Problem"}),"\n",(0,i.jsxs)(n.p,{children:["Let's suppose you created a new ASP.NET Core with the default Authentication (like in ",(0,i.jsx)(n.a,{href:"/blog/aspnet-identity-store-user-data-in-claims",children:"previous article"}),").\nThen you run it and try to register a new user. On the registration form, we need to enter a password.\nSince we need to register a user for testing purposes first of all - we don't want to make the password too complicated. We'd prefer to keep it simple and easy-to-remember (in the end - it's not a production-mode system!)"]}),"\n",(0,i.jsx)(n.p,{children:'However, if you try to enter something simple like "qwerty" or your name - you will get the following bunch of error messages:'}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Passwords must have at least one non-alphanumeric character."}),"\n",(0,i.jsx)(n.li,{children:"Passwords must have at least one digit ('0'-'9')."}),"\n",(0,i.jsx)(n.li,{children:"Passwords must have at least one uppercase ('A'-'Z')."}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"The reason for all these validation errors is that by default ASP.NET Core Identity has very strong password policies for the users. In the error messages above you can see the constraints which must be satisfied."}),"\n",(0,i.jsx)(n.h2,{id:"solution",children:"Solution"}),"\n",(0,i.jsxs)(n.p,{children:["The good news is that you can change these policies very easily, right in ",(0,i.jsx)(n.code,{children:"Configure"})," method of your ",(0,i.jsx)(n.code,{children:"Startup"})," class."]}),"\n",(0,i.jsxs)(n.p,{children:["All you need to do is to use another version of ",(0,i.jsx)(n.code,{children:"AddIdentity"})," method which accepts a lambda expression with ",(0,i.jsx)(n.code,{children:"IdentityOptions"})," parameter.\nSo the following default code that initializes the Identity:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:"services.AddIdentity<ApplicationUser, IdentityRole>()\n\t.AddEntityFrameworkStores<ApplicationDbContext>()\n\t.AddDefaultTokenProviders();\n"})}),"\n",(0,i.jsx)(n.p,{children:"should be changed to the something like the following:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:"services.AddIdentity<ApplicationUser, IdentityRole>(options => {\n\toptions.Password.RequiredLength = 3;\n\toptions.Password.RequiredUniqueChars = 0;\n\toptions.Password.RequireLowercase = false;\n\toptions.Password.RequireUppercase = false;\n\toptions.Password.RequireDigit = false;\n\toptions.Password.RequireNonAlphanumeric = false;\n})\n.AddEntityFrameworkStores<ApplicationDbContext>()\n.AddDefaultTokenProviders();\n"})}),"\n",(0,i.jsx)(n.p,{children:"The options above are self-descriptive, so no additional explanations are required."}),"\n",(0,i.jsx)(n.p,{children:"Of course, it's not good to leave such kind of password strength policies in production mode. That's why it will be a good idea to turn all those options off only in Development mode."}),"\n",(0,i.jsxs)(n.p,{children:["So, to make it possible we will need to add two more modifications to our ",(0,i.jsx)(n.code,{children:"Startup"})," class:"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:"public IHostingEnvironment Environment { get; }\n\npublic Startup(IConfiguration configuration, IHostingEnvironment env)\n{\n Configuration = configuration;\n Environment = env;\n}\n\npublic void ConfigureServices(IServiceCollection services)\n{\n . . . . . . .\n services.AddIdentity<ApplicationUser, IdentityR
1ole>(options => {\n if (Environment.IsDevelopment()) {\n options.Password.RequiredLength = 3;\n options.Password.RequiredUniqueChars = 0;\n options.Password.RequireLowercase = false;\n options.Password.RequireUppercase = false;\n options.Password.RequireDigit = false;\n options.Password.RequireNonAlphanumeric = false;\n }\n })\n .AddEntityFrameworkStores<ApplicationDbContext>()\n .AddDefaultTokenProviders();\n . . . . . . .\n}\n"})})]})}function p(e={}){const{wrapper:n}={...(0,o.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},8130:(e,n,t)=>{t.d(n,{A:()=>s});const s=t.p+"assets/images/password-weak-57d9c5b4082153e2d8bc2b5d39b75a01.jpg"},8453:(e,n,t)=>{t.d(n,{R:()=>r,x:()=>a});var s=t(6540);const i={},o=s.createContext(i);function r(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:n},e.children)}},1347:e=>{e.exports=JSON.parse('{"permalink":"/blog/aspnet-identity-weakening-password-policies","source":"@site/blog/2018-02-10-aspnet-identity-weakening-password-policies/index.md","title":"ASP.NET Identity - Weakening password policies","description":"This is the second article in a series of articles about ASP.NET Core Identity.","date":"2018-02-10T00:00:00.000Z","tags":[{"inline":true,"label":"ASP-NET-CORE","permalink":"/blog/tags/asp-net-core"},{"inline":true,"label":"ASP-NET-IDENTITY","permalink":"/blog/tags/asp-net-identity"},{"inline":true,"label":"PASSWORD","permalink":"/blog/tags/password"}],"readingTime":2.07,"hasTruncateMarker":true,"authors":[],"frontMatter":{"title":"ASP.NET Identity - Weakening password policies","tags":["ASP-NET-CORE","ASP-NET-IDENTITY","PASSWORD"],"slug":"aspnet-identity-weakening-password-policies"},"unlisted":false,"prevItem":{"title":"ASP.NET Identity - Migrating users\' passwords from ASP.NET Membership","permalink":"/blog/aspnet-identity-migrate-membership-passwords"},"nextItem":{"title":"ASP.NET Identity - Use claims to store additional user\'s data","permalink":"/blog/aspnet-identity-store-user-data-in-claims"}}')}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.