Historical Password Check

[jeffolmstead]

Does anyone know if there is an extension point (or at least if it seems feasible) that would allow me to:

1. Record historical password when a password is changed
2. Validate that the password being changed to has not been used in past

My goal would be to have the historical password (encrypted salt / hash) data stored right with the User document record. I probably would expose a setting to limit number of historical password data being stored.

[Piedone]

Hmm, there is no suitable event I'm aware of (like ILoginFormEvent is for login). On the short term, you could override AccountController.ILoginFormEvent() with your route and handle the password change yourself. On the longer term you could add an event handler for it, however, I'm not sure if generally people would accept an event handler that exposes a password directly (even though of course you can get that out somehow anyway but it can encourage security-unconscious behavior).

[jeffolmstead]

Thanks @Piedone, I will take a look at the ILoginFormEvent and see if that provides me an entrance. If I find a way to pull it off that doesn't feel to crazy, I would be open to having it be a feature pull request, but like you said, it might end up just staying a third-party module as I understand the sensitivity of the topic. I will close this at this time and try and swing by later with what I actually implemented

[Piedone]

No problem. Now I just noticed a copy-paste error above though: the action I was referring to is `AccountController.ChangePassword()"