Password policy enforces minimum complexity and rotation

PCI-DSS 4.0 Req 8.3.6 sets the minimum password complexity requirements; Req 8.3 requires strong authentication for all user IDs. A minimum password length of 6 characters with no complexity rules is crackable in seconds with commodity GPU rigs and common wordlists. CWE-521 (Weak Password Requirements) and OWASP A07 (Identification and Authentication Failures) both identify inadequate password policy as a direct authentication failure. NIST IA-5 provides the baseline: minimum 8 characters, not in a known compromised password list. Admin accounts with weak passwords in a CDE represent a trivial brute-force vector.

Configure minimum 12 characters with uppercase, lowercase, numbers, and symbols enforced at the auth provider level — not just in client-side validation that can be bypassed. Add a 90-day rotation reminder for admin accounts per PCI-DSS 4.0 Req 8.3.6.

// src/lib/auth/validate-password.ts
export function validatePassword(pw: string): boolean {
  return (
    pw.length >= 12 &&
    /[A-Z]/.test(pw) &&
    /[a-z]/.test(pw) &&
    /\d/.test(pw) &&
    /[!@#$%^&*()_+\-=\[\]{};'",./<>?]/.test(pw)
  );
}

For Supabase, set the password policy in the Auth dashboard under Authentication > Policies. For custom auth, call validatePassword() on the server side before hashing — never trust the client to enforce this.