Feature request: Password policy require 4 of 4 requirements

[richard.barnett]

Would this feature enforce the “Special characters” requirement when the database connection “Password Strength” policy is “good” or higher?

AFAICS this isn’t enforced when using Create User API even though “No more than 2 identical characters in a row” is enforced when policy is “excellent”.

I’m definitely +1 for this, even though the current NIST guidelines say that we:

[SHOULD] NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.

Related:

How to enforce Password to use special characters

I can’t see any configurations in auth0 dashboard → authentication → database → Username-password auth on how to enforce the special characters or how to make them 4/4 instead of “At least 3 of the following“ [image]