Block breached passwords at sign up

app.post("/signup", async (req, res) => {
  const { email, password } = req.body;

  if (password.length < 12) {
    return res.status(400).json({ error: "Use at least 12 characters." });
  }

  if (await isBreached(password)) {
    return res.status(400).json({
      error: "This password has appeared in a data breach. Please choose a different one.",
    });
  }

  await createUser(email, password);
  res.status(201).end();
});

async function isBreached(password) {
  try {
    const response = await fetch("https://api.finowl.co/v1/breaches/password", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.FINOWL_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ password }),
      signal: AbortSignal.timeout(5_000),
    });
    if (!response.ok) return false; // Fail open: never block sign up on an outage.
    const { breached } = await response.json();
    return breached;
  } catch {
    return false;
  }
}

import os
import requests
from flask import Flask, request, jsonify

app = Flask(__name__)
session = requests.Session()
session.headers["Authorization"] = f"Bearer {os.environ['FINOWL_API_KEY']}"


def is_breached(password: str) -> bool:
    try:
        response = session.post(
            "https://api.finowl.co/v1/breaches/password",
            json={"password": password},
            timeout=5,
        )
        if not response.ok:
            return False  # Fail open: never block sign up on an outage.
        return response.json()["breached"]
    except requests.RequestException:
        return False


@app.post("/signup")
def signup():
    email = request.json["email"]
    password = request.json["password"]

    if len(password) < 12:
        return jsonify(error="Use at least 12 characters."), 400

    if is_breached(password):
        return jsonify(
            error="This password has appeared in a data breach. Please choose a different one."
        ), 400

    create_user(email, password)
    return "", 201