Should we be checking password restraints on log in forms?

Question

We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization requirements, etc. These are enforced so a password cannot be created unless all restraints are met.

On a form that requires a user to log in with their password, should we be intercepting the password the user has provided and check it against our original restraints the user was required to follow when creating the password before sending it to LDAP for authentication.

I personally say besides basic data sanitation (to prevent SQL injection attacks, etc.) that there is no reason to check what the user provides as a password to log in after they've already created it. If it doesn't match, authentication will fail. However, other individuals in my department feel that those restraints should be checked again before sending the username/password combination to authenticate.

Which way is better? Why?

Answer 1

I'd recommend against it. If you want to protect from injection attacks, there are other, fundamentally better ways (e.g. prepared statements for SQL injection or correct escaping for other channels), besides the potentially malicious password will probably pass your restriction filters anyway (after all, you probably enforce minimum, not maximum password length, allow for ' character etc.)

Like Tom Leek said, it adds unnecessary complexity. If you want to enforce password change due to new restrictions taking place, you need to do this after authentication anyway, so you could store the 'password isn't good anymore' flag in session, but the validity check should be an addition to authentication process and not be done before sending the password to LDAP.

Answer 2

Checking again an already registered password is useful IF the rules you want to enforce have changed AND you have the possibility to make the user change his password so that the new one complies with the new rules. Otherwise it is a waste of time, and added complexity (complexity is Bad).

Answer 3

should we be intercepting the password the user has provided and check it against our original restraints the user was required to follow when creating the password before sending it to LDAP for authentication.

To what end? This is one more feature to get wrong and leak information. How much benefit can this feature provide for how much it costs to get right, iron out bugs, and deal with unforeseen issues that lock out customers?