no-weak-password-recovery

{
  "rules": {
    "secure-coding/no-weak-password-recovery": ["error", {
      // Minimum bits of entropy for tokens (default: 128)
      "minTokenEntropy": 128,

      // Maximum lifetime of recovery tokens in hours (default: 1)
      "maxTokenLifetimeHours": 1,

      // Functions considered secure for token generation (default: randomBytes, uuidv4, etc.)
      "secureTokenFunctions": ["randomBytes", "uuidv4", "uid"],

      // Keywords to identify recovery flows
      "recoveryKeywords": ["forgot", "recover", "reset", "password"]
    }]
  }
}

// Weak token generation
const resetToken = Math.random().toString(36);

// Relying on timestamps
const token = Date.now() + userId;

// KBA (Knowledge Based Authentication)
if (answer === user.securityAnswer) {
  allowReset();
}

// Cryptographically secure token
import { randomBytes } from 'crypto';
const token = randomBytes(32).toString('hex');

// Token with expiration
const resetToken = {
  token: randomBytes(32).toString('hex'),
  expiresAt: Date.now() + 3600000, // 1 hour
  userId: user.id,
};
await db.passwordResets.create(resetToken);

// Rate limiting
import rateLimit from 'express-rate-limit';
const resetLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 3, // 3 requests per window
});
app.post('/reset-password', resetLimiter, async (req, res) => {
  // Implementation
});

// Validate token on use
const reset = await db.passwordResets.findOne({ token });
if (!reset || reset.expiresAt < Date.now()) {
  throw new Error('Invalid or expired token');
}

{
  rules: {
    'secure-coding/no-weak-password-recovery': ['error', {
      minTokenEntropy: 128,
      maxTokenLifetimeHours: 24,
      recoveryKeywords: ['reset', 'recover', 'forgot', 'password'],
      secureTokenFunctions: ['randomBytes', 'crypto.randomUUID']
    }]
  }
}

🔒 CWE-640 OWASP:A07-Auth CVSS:9.8 | Weak Password Recovery | CRITICAL [SOC2,PCI-DSS,HIPAA]
   Fix: Use cryptographically secure tokens with expiration | https://cwe.mitre.org/...

// ❌ NOT DETECTED - From config
const password = config.dbPassword;

// ❌ NOT DETECTED - Env var
const secret = process.env.API_KEY;

// ❌ NOT DETECTED - Dynamic
const cred = credentials[type];