Prevent Password Reuse

[cptnsx]

I'm not a programmer, but I'm on the security side so I need to validate things to ensure this software will meet our needs. I see in the documentation that password history can be tracked to ensure passwords are changed but is there anything to prevent password reuse i.e. reusing the same password?

I see the parameter ACCOUNT_REMEMBER_ME_EXPIRY but I don't see exactly what that does. Does this parameter remember and prevent password reuse or just password history in general.

[KatherineMichel]

It looks like ACCOUNT_REMEMBER_ME_EXPIRY is for session expiration, not password reuse.

https://github.com/pinax/django-user-accounts/blob/master/account/views.py#L419

I'm looking through the code and I don't see password reuse prevention.

[cptnsx]

Thanks.

[sar99]

Hello!
I wanted to add this feature, may I take this issue?

[KatherineMichel]

@sar99 You're welcome to do it. I'm not sure how soon your PR will be reviewed though. The lead maintainer @brosner is starting a new job and stuff.