Password policy meets NIST 800-63B guidelines

CMMC 2.0 IA.L1-3.5.2 (NIST 800-171r2 3.5.2) and NIST SP 800-63B both require that password policies resist guessing attacks. A client-side-only minimum length of 6 characters — enforced in a React component but not in the API route — is trivially bypassed with a direct POST request. Short passwords combined with no rate limiting on authentication endpoints allow automated credential stuffing or brute-force attacks to succeed against FCI-bearing accounts within minutes. CWE-521 (Weak Password Requirements) and OWASP A07 name this directly. NIST 800-63B recommends 8-character minimums as a floor; 12+ is the current defensible standard.

Validate password length server-side using Zod or equivalent. Add rate limiting on every auth endpoint — 5 attempts per minute per IP is a reasonable starting point for CMMC contexts:

// lib/validation/auth.ts
import { z } from 'zod'
export const registerSchema = z.object({
  email: z.string().email(),
  password: z.string().min(12, 'Password must be at least 12 characters').max(128),
})

// app/api/auth/register/route.ts
const attempts = new Map<string, { count: number; resetAt: number }>()
function checkRateLimit(ip: string): boolean {
  const now = Date.now()
  const rec = attempts.get(ip)
  if (!rec || rec.resetAt < now) { attempts.set(ip, { count: 1, resetAt: now + 60_000 }); return true }
  if (rec.count >= 5) return false
  rec.count++; return true
}

export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for') ?? 'unknown'
  if (!checkRateLimit(ip)) {
    return Response.json({ error: 'Too many attempts. Try again later.' }, { status: 429 })
  }
  const result = registerSchema.safeParse(await req.json())
  if (!result.success) return Response.json({ error: 'Invalid input' }, { status: 400 })
  // Proceed with result.data
}

For external auth providers (Supabase Auth, Auth0, Clerk), verify minimum password length is set in the provider dashboard — application code alone does not control it.