Prevent same password change.

[danyhiol]

How can one prevent a user to change his password using the same password?

Let's say a user has a current password: "password". During password change, the user provides the same password: "password". This should not be allowed (at least in my case).
How can I prevent this? I was expecting a hook but there is actually nothing.

[darkbasic]

You can use the validatePassword option in @accounts/module-password. There are plenty of examples with validateNewUser that you can look at. I suggest you to use the new Accounts.js 1.0: #1258

[danyhiol]

validatePassword: Function that check if the password is valid. This function will be called when you call createUser and changePassword.
validatePassword is called with password from createUser & changePassword. Now having only the password, how do I check if this password matches the previous password created by the user? Even if I can look into the Users collection and retrieve the user with that password, it won't be effective as the same password could be used by multiple users.
validateNewUser won't help here as it only happens at user's creation.

[darkbasic]

The same way we do when you authenticate:

accounts/packages/password/src/accounts-password.ts

Line 767 in 7c05abf

const isPasswordValid = await this.options.verifyPassword(password, hash);

[danyhiol]

But validatePassword method is not async and does not provide the current password hash nor current user:
const hash = await this.db.findPasswordHash(foundUser.id);

[darkbasic]

Sorry I didn't look at the signature and I thought it was similar to validateNewUser.
Have a look at this PR: #1265
New alpha packages should be released shortly, so you can test them and let me know if it works for your use case.

In the meantime @pradel do you think that would be a viable approach? I made validatePassword async and in resetPassword and changePassword I moved the validatePassword call after we retrieve the user so that we can pass it as second argument. In createUser I don't pass any user as second argument so he knows not to run the same-password logic whenever the second arg is undefined.

Passing the old password as second argument wouldn't be a viable option because while we have it at hand in changePassword we should make additional database calls in resetPassword to retrieve it. In alternative we could add a new option to @accounts/password that prevents same password changes. Maybe that would make more sense?

[danyhiol]

Adding an option: preventSamePasswordChange would be great, as it will prevent writing a custom logic just for that purpose. One can even go a step further and prevent the use of already-used passwords: meaning prevent users from using any password they already used. But this would require keeping track of all password changes...