## Rollout This is enabled on GitLab.com in production. See https://gitlab.com/gitlab-org/gitlab/-/issues/363445#calendar-clock10-arrow_forward-specific-proposal-arrow_backward-clock10-calendar It is merged in canonical with the feature flag removed, aiming at %"15.7". ## Problem to solve As well-articulated in https://gitlab.com/gitlab-org/gitlab-ce/issues/36568, we should warn users who are using potentially unsafe passwords. Password reuse is common, but potentially unsafe. We should encourage users to use strong, unique passwords when accessing GitLab instances, especially when using GitLab.com. ## Proposal * Check on new user registration with a username/password * Check on user password update #### MVC 1 Form validation when creating a password which checks against known weak passwords. Current status: Deployed behind default disabled feature flag. #### Not in this proposal * When a user logs into GitLab with a password, we should check that password against a list. * Using third-party "pwned" APIs like https://haveibeenpwned.com/API/v2 * Checking existing users outside of a password-changing event (i.e. displaying warning banners at log in) * Administrator-configurable weak-password list * Allowing admins to enable/disable the check. See: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/86310#note_951941665 * Password complexity. See: https://gitlab.com/gitlab-org/gitlab/-/issues/18691#note_934751134 / https://gitlab.com/gitlab-org/gitlab/-/merge_requests/82798+