Auth0 Flexible Password Policy Blocks Profile Data on Passwords
Last Updated:
Overview
When using the Auth0 flexible password policy feature for database connections, the Block profile data in passwords setting evaluates the full value of the selected fields. If a user attempts to set a password containing the exact full value of a blocked field, the action fails. However, passwords containing only substrings of the blocked field value succeed.
Applies To
- Auth0
- Database Connections
- Flexible Password Policy
Solution
How does the Block profile data on passwords feature evaluate substrings?
When using the flexible password policy feature, under Authentication Methods > Password > Security, the Block profile data in passwords setting in Auth0 evaluates the full values of all selected fields.
For example, if an administrator selects the username field to be blocked and the field contains the value "JohnDoe", Auth0 rejects any password that includes the entire "JohnDoe" string. Conversely, Auth0 accepts passwords that include only substrings of the full value, such as "John", "Doe", or "JohnD".
