Provide hooks for password policy

[Paul McMillan]

While it is possible to change the validation for new passwords by subclassing the form, I think that Django should provide a more friendly interface for this. We should have a pluggable password authentication framework which enforces no rules by default, but comes with several reasonable example policies which may be enabled.

Problems to be solved include:

• Informing the user of the various password requirements
• Allowing policies to chain together smoothly
• Provide flexibility for complex requirements (some may include their own models)
• Backwards compatibility
• Javascript validation assistance (someday, maybe?)
• HTML5 support (i.e. the pattern attribute)
• Prevent using email, username or other user attributes as (part of) passwords
• Prevent reuse of old passwords

[Collin Anderson]

mailing list discussion: ​https://groups.google.com/d/topic/django-developers/kec0UF_xc3k/discussion

[Shai Berger]

I replaced two requirements that seem to be applicable to login pages (rate-limiting & lockout, captcha) with ones more applicable to password setting (use of user attributes, old password reuse).