Set default password policies in base settings

babybuddy/settings/base.py

@@ -234,16 +234,35 @@
 
 
 # Security
-# https://docs.djangoproject.com/en/3.2/topics/http/sessions/#settings
-# https://docs.djangoproject.com/en/3.2/ref/csrf/#settings
 
-# See https://docs.djangoproject.com/en/3.2/ref/settings/#secure-proxy-ssl-header for why and when to set this
+# https://docs.djangoproject.com/en/3.2/ref/settings/#secure-proxy-ssl-header
 if os.environ.get('SECURE_PROXY_SSL_HEADER'):
     SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
 
+# https://docs.djangoproject.com/en/3.2/topics/http/sessions/#settings
 SESSION_COOKIE_SECURE = True
+
+# https://docs.djangoproject.com/en/3.2/ref/csrf/#settings
 CSRF_COOKIE_SECURE = True
 
+# https://docs.djangoproject.com/en/3.2/topics/auth/passwords/
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+        'OPTIONS': {
+            'min_length': 8,
+        }
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
 
 # Django Rest Framework
 # https://www.django-rest-framework.org/

babybuddy/static_src/scss/forms.scss

@@ -65,6 +65,15 @@
     z-index: 1030;
 }
 
+// Tweak padding on form field help blocks.
+.help-block {
+    ul {
+        padding-left: 1rem;
+        padding-bottom: 0;
+        margin-bottom: 0;
+    }
+}
+
 @include media-breakpoint-up(md) {
     // Restore regular inline button on larger screens.
     .submit-primary {

babybuddy/tests/tests_forms.py

@@ -75,8 +75,8 @@ def test_user_forms(self):
             'first_name': 'User',
             'last_name': 'Name',
             'email': 'user@user.user',
-            'password1': 'password',
-            'password2': 'password'
+            'password1': 'd47o8dD&#hu3ulu3',
+            'password2': 'd47o8dD&#hu3ulu3'
         }
 
         page = self.c.post('/users/add/', params)