Password requirements enforced

Weak password requirements are the primary enabler of credential-stuffing attacks: attackers replay breached credential lists at scale and succeed wherever short or trivially guessable passwords are allowed. NIST 800-63B and NIST 800-53 rev5 IA-5(1) mandate a minimum of 8 characters (NIST guidance recommends 12+) with complexity requirements, and AC-7 requires rate-limiting after repeated failed authentication attempts. CWE-521 (Weak Password Requirements) and OWASP A07 both rank this as a systemic authentication failure. Client-only validation is bypassed by any direct API call, so server-side enforcement is non-negotiable.

Enforce password complexity and rate-limiting server-side in every password-accepting API route. Client-side validation can improve UX but must never be the sole gate.

// lib/auth-validation.ts
import { z } from 'zod'

export const passwordSchema = z.string()
  .min(12, 'Minimum 12 characters')
  .regex(/[A-Z]/, 'At least one uppercase letter')
  .regex(/[a-z]/, 'At least one lowercase letter')
  .regex(/[0-9]/, 'At least one digit')
  .regex(/[^A-Za-z0-9]/, 'At least one special character')

Apply rate-limiting at the route level using @upstash/ratelimit or express-rate-limit: no more than 5 password submissions per minute per IP and per user identifier. Validate with Zod before any database interaction — never trust client-supplied values.