MEDIUM AI PREVALENCE: MEDIUM auth.flow.password-min-length

A password validation schema is enforcing a minimum length of less than 8 characters.

CWE-521 OWASP API2:2023 js · ts

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

NIST SP 800-63B recommends ≥ 8 characters for user-chosen passwords (with NO mandatory complexity rules: length is the dominant strength factor). OWASP ASVS V2.1.1 requires ≥ 12 for high-assurance applications.

Common LLM-generated mistake: password: z.string().min(6) because "6 looks reasonable". It isn't. Bump the floor to 8 minimum, 12 preferred.

VULNERABLE

vulnerable.ts

import { z } from 'zod';

// ruleid: auth.flow.password-min-length
export const signupSchema = z.object({
  email: z.string().email(),
  password: z.string().min(6),
});

// ruleid: auth.flow.password-min-length
export const resetSchema = z.object({
  password: z.string().min(4),
  confirm: z.string(),
});

// ruleid: auth.flow.password-min-length -- custom-message form
export const customMsgSchema = z.object({
  password: z.string().min(6, 'Password too short'),
});

SAFE

safe.ts

import { z } from 'zod';

// ok: auth.flow.password-min-length
export const signupSchema = z.object({
  email: z.string().email(),
  password: z.string().min(12),
});

// ok: auth.flow.password-min-length
export const tightSchema = z.object({
  password: z.string().min(8).max(128),
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.flow.password-min-length -- <reason>

References

https://pages.nist.gov/800-63-3/sp800-63b.html ↗https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html ↗