prevent unicode-confusion in password by applying PRECIS, and username/email address by applying unicode NFC normalization

Browse Source

an é (e with accent) can also be written as e+\u0301. the first form is NFC,
the second NFD. when logging in, we transform usernames (email addresses) to
NFC. so both forms will be accepted. if a client is using NFD, they can log
in too.

for passwords, we apply the PRECIS "opaquestring", which (despite the name)
transforms the value too: unicode spaces are replaced with ascii spaces. the
string is also normalized to NFC. PRECIS may reject confusing passwords when
you set a password.

...

This commit is contained in:

Mechiel Lukkien

2024-03-08 23:29:15 +01:00

parent 8e6fe7459b

commit c57aeac7f0

99 changed files with 59625 additions and 114 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

1361

vendor/golang.org/x/text/width/tables13.0.0.go generated vendored Normal file

File diff suppressed because it is too large Load Diff