Documentation
¶
Overview ¶
Package hibp checks passwords against the Have I Been Pwned range API, for password.CheckBreached.
Only the first five hex characters of the password's SHA-1 leave the process (k-anonymity): the service answers with every suffix it knows under that prefix, and the match happens here. Responses are padded, so the size of the answer does not hint at the prefix either.
Index ¶
Constants ¶
const DefaultBaseURL = "https://api.pwnedpasswords.com/range/"
DefaultBaseURL is the public range API.
const DefaultTimeout = 5 * time.Second
DefaultTimeout bounds one lookup. The check runs inside a sign-up request, so a slow service must fail it in seconds, not hang it.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker implements password.BreachChecker against the range API. It is safe for concurrent use; build one with New and share it.
func (*Checker) Breached ¶
Breached reports whether password appears in a known breach. Padding rows never count as a match. When the service cannot answer it returns the error, or false with FailOpen.
func (*Checker) BreachedMessage ¶
BreachedMessage is the WithMessage text, or "" for the default; it makes the checker a password.BreachMessenger.
type Option ¶
type Option func(*Checker)
Option configures the checker; pass options to New.
func FailOpen ¶
func FailOpen() Option
FailOpen accepts the password when the service cannot be reached, instead of failing the sign-up. The default is to return the error, because a silent pass is a check that never runs; an app that prefers availability names that choice here.
func WithBaseURL ¶
WithBaseURL points the checker at another server, such as a self-hosted mirror or a test server.
func WithHTTPClient ¶
WithHTTPClient replaces the client, such as to add a proxy or tracing. The replacement's own timeout applies instead of DefaultTimeout.
func WithMessage ¶
WithMessage words the refusal of a breached password (better-auth's customPasswordCompromisedMessage). The password plugin answers password.breached with this message instead of the declared one; the code and the status stay, and a WithMessages catalogue entry for the code still wins in its locale. See password.BreachMessenger.
Source Files