expire user password

[黄祥]

hi,

just wondering is it possible to have expire password in web2py application? perhaps something like the most os have (windows, linux) that have an option to set the user password is expired let say in 90 days, or 30 days.

thanks and best regards,
stifan

[Massimo Di Pierro]

There is no built-in mechanism since we do not store the time when a password changes but you can do it in this way:

auth.settings.extra_fields['auth_user'] = [Field('password_charged_on','datetime',compute=lambda row: row.password and request.now, writable=False)]

if auth.user and auth.user.password_charged_on + datetime.timedelta(days=30)<request.now: redirect(URL('some_error_page'))

[黄祥]

i'll try, thank you so much, massimo.

[Leonel Câmara]

I would recommend against this. Passwords expiring is seriously annoying and the security benefits are questionable to say the least. Just demand better passwords and lock users after a few tries if you need more security.

[黄祥]

thanks leonel for your recommendation, i'll look forward about lock user after a few input (wrong password) tried.