# Weak Password Requirements (CWE-521)

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

**Stack:** Go

- Prevalence: Élevée Fréquemment exploitée
- Impact: Élevé 1 règles de sévérité élevée
- Prevention: Documentée 2 exemples de correctifs

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

Without strong password requirements, users often choose weak, easily guessable passwords. This makes brute-force and dictionary attacks more likely to succeed.

## Prevention

Stratégies de prévention pour Weak Password Requirements basées sur 1 règles de détection Shoulder.

### Go

Enforce minimum 12-character passwords with complexity requirements

## Consequences

- Obtenir des privilèges
- Contourner le mécanisme de protection

## Mitigations

- Imposez une longueur minimale de mot de passe (12 caractères ou plus recommandés)
- Vérifiez les mots de passe par rapport aux bases de fuites connues
- Mettez en place l'authentification multifacteur

## Detection

- Total rules: 2
- Languages: go, javascript, typescript

## Rules by Language

### Go (1 rules)

- **Weak Password Policy** [MEDIUM]: Password validation requires fewer than 8 characters.
  - Remediation: Enforce minimum password length of 12+ characters with complexity requirements.

```go
func validatePassword(password string) error {
    if len(password) < 12 {
        return errors.New("password must be at least 12 characters")
    }
    // Add complexity checks: uppercase, lowercase, digit, special char
    return nil
}
```

Learn more: https://shoulder.dev/learn/go/cwe-521/weak-password-policy