Django Password Validation Enhancement Proposal

Your suggestion to enhance Django's password validation system by adding a validator for repeated patterns is a thoughtful security improvement. Currently, Django includes several built-in validators but doesn't specifically check for repeated patterns like aaaaaaaaaaaa.

Current Django Password Validators

Django's password validation framework includes four built-in validators:

1. UserAttributeSimilarityValidator - Checks if the password is too similar to user attributes
2. MinimumLengthValidator - Enforces a minimum password length
3. CommonPasswordValidator - Checks against a list of 20,000 common passwords
4. NumericPasswordValidator - Ensures passwords aren't entirely numeric

Implementing a Pattern Repetition Validator

Your proposed implementation for detecting repeated patterns is a good starting point. Here's how you could structure a complete custom validator for Django:

PYTHONCopied
import re
from django.core.exceptions import ValidationError
from django.utils.translation import gettext as _
from django.contrib.auth.password_validation import BasePasswordValidator

class RepeatedPatternValidator(BasePasswordValidator):
    """
    Validate that the password doesn't contain repeated patterns.
    """
    def __init__(self, max_repeats=1):
        self.max_repeats = max_repeats
        
    def validate(self, password, user=None):
        repeat_matcher = re.compile(r'(.+?)\1+')
        match = repeat_matcher.match(password)
        if match:
            repeat_cnt = len(match.group(0)) // len(match.group(1)) - 1
            if repeat_cnt > self.max_repeats:
                raise ValidationError(
                    _("This password contains too many repeated patterns."),
                    code='password_repeated_pattern',
                )
    
    def get_help_text(self):
        return _("Your password cannot contain repeated patterns.")

Adding to Your Project

To use this validator, you would add it to your AUTH_PASSWORD_VALIDATORS setting:

PYTHONCopied
AUTH_PASSWORD_VALIDATORS = [
    {
        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
    },
    {
        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
    },
    {
        "NAME": "path.to.your.RepeatedPatternValidator",
        "OPTIONS": {
            "max_repeats": 1,
        }
    },
]

Additional Considerations

Your suggestion to also check for sequential characters (like "abcdef" or "123456") would be another valuable addition. This could be implemented as a separate validator using similar principles.

These enhancements would indeed improve Django's default security posture without requiring third-party packages, making it more accessible for developers who may not be security experts.