Enhance login security

[pronguen]

How it works

Login security can be enhanced.

Improvement suggestion

Software

• Strengthen password requirements (see recommendations) : find a good library example : https://pypi.org/project/password-strength/
  • Force a minimum of 8 characters alphanumeric with at least 1 uppercase, 1 lowercase, 1 digit (backend control but exposed so that the UI can use the check)
  • In the form description: specify password requirements for the user
  • Nice to have: Allow a "show password" option in the login form (Add a way to display the password as the user types it (login form) #2033)
• Add a function in the professional interface, user editor, for generating a strong password, seeing it, but then not editing it manually.
  • It generates a random alphanumeric sequence of 8 characters
  • When generating the password, it is automatically copied to the clipboard so that the librairian can then easily give it to the patron.
• Modify feedback message in case of a failed attempt so that the user cannot know whether the user or the password is wrong (supercharge invenio-accounts failed login messages to return the same message). (security: uniformize failed login message #3189)
  • Modify json response on failed login so that we don't know the problematic field.
• Add an enumeration value in the user field gender: no_information
• A permanent message appears on the login screen during 3 months: Par mesure de sécurité, votre mot de passe a été réinitialisé le XX.XX.XXXX afin de respecter des contraintes plus exigeantes. Si vous ne parvenez pas à vous connecter, veuillez définir un nouveau mot de passe ou adressez-vous à votre bibliothèque.
  • This should be in a config so that different instances can show the message or not.
• Change the login information for the test version

Tasks in production (see gitlab wiki)

• All user's passwords are reset according to the new requirements
• (nice-to-have) Restrict the number of consecutive accesses by IP to certain critical URLs to prevent exploits

Linked to this issue

#1534

Context

Issue suggested by Adrien Kunysz