public void verifyPasswordStrength ( String oldPassword , String newPassword , T user ) throws AuthenticationException { List < Rule > rules = getPasswordRules ( ) ; PasswordValidator validator = new PasswordValidator ( rules ) ; PasswordData passwordData = new PasswordData ( new Password ( newPassword ) ) ; RuleResult result = validator . validate ( passwordData ) ; if ( ! result . isValid ( ) ) { StringBuilder messages = new StringBuilder ( ) ; for ( String msg : validator . getMessages ( result ) ) { messages . append ( msg ) . append ( "\n" ) ; } throw new AuthenticationException ( messages . toString ( ) ) ; } }
Ensures that the password meets site - specific complexity requirements like length or number of character sets . This method takes the old password so that the algorithm can analyze the new password to see if it is too similar to the old password . Note that this has to be invoked when the user has entered the old password as the list of old credentials stored by ESAPI is all hashed . Additionally the user object is taken in order to verify the password and account name differ .