# How to customize/override the user password validation?

**URL:** <https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844>\
**Category:** Questions\
**Tags:** v3\
**Created:** [July 7, 2019, 12:55pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844 "2019-07-07T12:55:51Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![warg](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@warg](https://forum.getkirby.com/u/warg)\
**Post date:** [July 7, 2019, 12:55pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/1 "2019-07-07T12:55:51Z")

</div>

Hello,

I tried to find out how I can customize/override the user password validation process but I didn’t find a proper function to override. I found these 3 at [https://getkirby.com/docs/reference/objects/user?advanced=yes](https://getkirby.com/docs/reference/objects/user?advanced=yes) :

- [$user-\>changePassword()](https://getkirby.com/docs/reference/objects/user/change-password)
- [User::hashPassword()](https://getkirby.com/docs/reference/objects/user/hash-password)
- [$user-\>validatePassword()](https://getkirby.com/docs/reference/objects/user/validate-password)

None of these 3 validates the password according to the criterias when you want to change the current password of an user. I also checked the validators but there is no user password validator. So what do I have to override to apply custom password rules like length, special characters, etc.?

Is the proper way to use a `user.changePassword:before` hook and then throw an exception if the new password doesn’t fulfills the criterias to prevent the password change?

A general question about hooks: Are hooks used by Kirby 3’s core or are they non-implemented? Like does Kirby 3 use any hook itself or are they just provided for the customers/developers of customer projects? I’m asking because I think that’s the only place left I could look at to find the validation of Kirby 3 user passwords but I don’t find any source code of the hook if I search for `changePassword`, `user.changePassword` or `user.changePassword:before` via Github’s repository search and thus I’m not sure about this.

Best Regards,

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [July 7, 2019, 4:21pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/2 "2019-07-07T16:21:50Z")

</div>

Length validation for the changePassword() method happens here

```auto
    {
        if (Str::length($password ?? null) < 8) {
            throw new InvalidArgumentException([
                'key' => 'user.password.invalid',
            ]);
        }

        return true;
    }

```

(`/kirby/src/Cms/UserRules.php`)

I don’t know if there is a way to override these methods, though. The only way I can think of is via a user model, but that would be role based, not in general.

Or you can implement your own login view with your own authentication methods: [https://getkirby.com/docs/reference/plugins/extensions/panel-login](https://getkirby.com/docs/reference/plugins/extensions/panel-login)

---

<div class="post-metadata">

**Author:** ![warg](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@warg](https://forum.getkirby.com/u/warg)\
**Post date:** [July 7, 2019, 4:48pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/3 "2019-07-07T16:48:42Z")

</div>

Is there a reason why a hook like I described wouldn’t work? It’s fine if the 8 chars minimum password validation still kicks in because the password strength validation will be stronger than looser so \> 8 chars. I suspect I misunderstand the way I can use hooks in this case like my idea wouldn’t work at all.

An own login view seems overkill if I like to share the results with third parties as a plugin.

What I try to achieve: I want to enforce a specific length with at least one special character and then I would like to validate the password against the Have I been Pwned API to prevent weak passwords: [https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange](https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange)

The need for this is because Kirby 3 offers zero bruteforce protection and this has been a known successful attack scenario in the past and I prefer a secure authentication over some htaccess or firewall rules. The panel has to be usable (I can’t disable it in my use case). So I think implementing better passwords is easier than implementing a bruteforce protection in Kirby 3.

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [July 7, 2019, 5:20pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/4 "2019-07-07T17:20:35Z")

</div>

> [@warg](#):
>
> Kirby 3 offers zero bruteforce protection

That’s not quite true, because after each wrong try Kirby sleeps a while and also, it tracks invalid login trials and blocks an IP after 10 wrong trials (default setting, can be changed in config).

But yes, a route before hook could work.

---

<div class="post-metadata">

**Author:** ![warg](https://avatars.discourse-cdn.com/v4/letter/w/90ced4/32.png) [@warg](https://forum.getkirby.com/u/warg)\
**Post date:** [July 7, 2019, 7:03pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/5 "2019-07-07T19:03:57Z")

</div>

I’m surprised @texnixe! Is this at all documented somewhere? I found nothing in the references, the [security guide](https://getkirby.com/docs/guide/security#passwords) (which then contains a misleading sentence about bruteforcing Kirby 3) and only outdated posts on this then. I did some research in the past before I wanted to do this and I found zero information about this.

Edit: I found this [How does Kirby 2.2 bruteforce protection work?](https://forum.getkirby.com/t/how-does-kirby-2-2-bruteforce-protection-work/2654) and [Is Kirby secure?](https://forum.getkirby.com/t/is-kirby-secure/1806/9). Seems like the first time I didn’t find the first thread. Seems like there is a bruteforce protection beginning to ban after 5 (?) tries. At least it triggered before 10 times.

---

<div class="post-metadata">

**Author:** ![holmey](https://avatars.discourse-cdn.com/v4/letter/h/aca169/32.png) [@holmey](https://forum.getkirby.com/u/holmey)\
**Post date:** [March 3, 2023, 7:51pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/6 "2023-03-03T19:51:00Z")

</div>

Is there any update on this topic? It would be really helpful if there would be an option to easily be able to change password rules. Strict password policies are a common request by customers we are working for.

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [March 3, 2023, 8:49pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/7 "2023-03-03T20:49:56Z")

</div>

You would have to overwrite the `validatePassword()` method in a custom user class.

---

<div class="post-metadata">

**Author:** ![ssn](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@ssn](https://forum.getkirby.com/u/ssn)\
**Post date:** [November 24, 2024, 11:51am UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/8 "2024-11-24T11:51:42Z")

</div>

I managed to produce a simple login page for guests for a temporary page, that only asks for a password (common for all and shared in an email invite), as the email is hard-coded.

But to really make the login a breeze for these people, I’d like to use a shorter password, only for this user role and this page. How and where could I overwrite this?

---

<div class="post-metadata">

**Author:** ![texnixe](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/texnixe/32/5754_2.png) [@texnixe](https://forum.getkirby.com/u/texnixe)\
**Post date:** [November 24, 2024, 3:51pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/9 "2024-11-24T15:51:36Z")

</div>

You can overwrite the login method in a User model: [User models | Kirby CMS](https://getkirby.com/docs/reference/plugins/extensions/user-models)

---

<div class="post-metadata">

**Author:** ![ssn](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@ssn](https://forum.getkirby.com/u/ssn)\
**Post date:** [December 3, 2024, 9:51pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/10 "2024-12-03T21:51:39Z")

</div>

Thanks for your reply. So I would copy & paste the password validation thing from UserRules.php, and maybe put it inside that code on the user models page you linked? This really ain’t my forte, that’s why I’m asking…

---

<div class="post-metadata">

**Author:** ![ssn](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@ssn](https://forum.getkirby.com/u/ssn)\
**Post date:** [December 4, 2024, 6:30pm UTC](https://forum.getkirby.com/t/how-to-customize-override-the-user-password-validation/14844/11 "2024-12-04T18:30:05Z")

</div>

Now I tried just changing the password length here to “\< 7”, i.e. one shorter (just the simplest solution I figured to enable a certain password for a temporary project). But when I try to create a new user, the panel still requires a password of 8 or more characters. Why is that?