Download the PHP package square1/pwned-check-laravel without Composer

On this page you can find all versions of the php package square1/pwned-check-laravel. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package pwned-check-laravel

Pwned Check Validator for Laravel

Laravel validation rule to determine whether a password has appeared in a set of known compromised passwords. This is a PHP wrapper for the Pwned Check utility class, making use of the Pwned Passwords service provided by Troy Hunt.

Install

Via Composer

Laravel 5.5+

If you're using Laravel 5.5+, then the package will be auto-discovered.

Laravel <= 5.4

To use the Pwned Check validation rule, you must register the provider when bootstrapping your Laravel application.

Find the providers key in your config/app.php and add the below.

Publishing config file

This will publish the configuration file to pwned-check.php.

Configuration Options

A number of configuration options are available to modify the behaviour of the class.

Option Default Comment
endpoint https://api.pwnedpasswords.com/range/ Service endpoint url
user_agent Square1 Pwned PHP package User agent to use - api calls without a user agent are rejected
connection_timeout 0 Initial curl connection limit (0 for off). If connection takes longer than X seconds to establish, it's terminated
remote_processing_timeout 0 Number of seconds after which to kill a slow-responding connection (0 for off)
minimum_occurrences 1 Minimum number of times a password needs to appear in breaches before being considered compromised

Usage

FAQ

How do I set the validation error message shown?

In the lang/{LANG}/validation for each language your app runs in, the message can be set within the custom array:

How do you decide if a password is "known compromised"?

The Pwned Passwords service provided by Troy Hunt is a great resource that aggregates passwords found in known data breaches. The api allows us to check whether a password has appeared in previous data breaches, and also how frequently it shows up. The frequency allows us to decide how strict we want to be when deciding if a password is to be considered compromised. For example, abcd1234 may show up 334,000 times in data breaches, while totallyuniqueandrandompass1234 may only show up once. Depending on your use case, it may be appropriate to only blacklist widely compromised passwords. The frequency count is what allows us to do this.

Does sending a password to the service not constitute a security risk?

The Pwned password api allows for range queries to be made. This involves hashing the password via this library within your application, and sending a partial section of it to the api. The api returns a set of password hashes (and frequency counts for each). These can then be matched against the full password hash, which never needs to leave the application. Cloudflare worked closely with Troy on the design of this api, and go into a lot more detail on this approach to using k-anonymity in this blog post.

What if the api server is slow to respond? Will my app have problems?

Typical api responses are blazingly-fast - the article here is worth a read. However, it's possible that at some point there'll be a connection issue or some other performance issue with the service. To protect your app in these cases, you can set the connection_timeout and remote_processing_timeout config values. These are the seconds to wait before killing a curl connection and wait time after connection respectively. If the service call is terminated due to one of these timeouts being reached, a Square1\Pwned\Exception\ConnectionFailedException will be thrown.

If the api does time out, does that behave the same as if the password is compromised?

This can be controlled through the fail_on_timeout config value. When it is set to true, any connection failure will be treated as a validation failure. However, you may wish to have this compromised check as a less critical one, so in the event of a remote service failure you'd prefer that your user registration continues unimpacted. Setting this value to false will mean that a connection failure won't trigger a validation failure.

Are the api results cached?

The api results are cached for a day by default. This value can be altered in the cache_default_ttl config variable.

License

The MIT License (MIT). Please see License File for more information.


All versions of pwned-check-laravel with dependencies

PHP Build Version
Package Version
Requires php Version >=7.0
square1/pwned-check Version ^1.2
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package square1/pwned-check-laravel contains the following files

Loading the files please wait ....