Strong Password Policy Management

Overview

Znode provides a configurable password policy framework that allows Administrators to control password requirements at the store level. A new store setting, Enable Strong Password Policy, determines whether Customers and Buyers on Storefront and Page Builder password workflows must follow the enhanced password policy or the existing legacy password policy.

This enhancement enables organizations to introduce stricter password requirements gradually across stores while maintaining a consistent user experience.

The password policy applies to:

• Storefront
• Page Builder
• API integrations related to Storefront password operations

The following areas are not affected by the store-level setting:

• Admin Console password management
• Administrator login
• Administrator password changes
• Administrator password resets

Administrative users always follow the enhanced password policy regardless of store configuration.

The policy does not apply to BStore independently. A BStore inherits the password policy setting from its parent store.

Existing user passwords remain valid and are not affected until a password is changed or reset.

---

Password Policy Configuration

A new Store Additional Attribute group named Password Policy Setting is available at the store level.

Navigation

Stores > Store Details > Additional Attributes > Password Policy Setting

Setting

Setting	Values	Default Value
Enable Strong Password Policy	Yes / No	No

Behavior

Value	Result
Yes	Enhanced password policy is enforced for Storefront and Page Builder password workflows.
No	Legacy password policy remains in effect.
Default	All new and existing stores are created with the setting set to No.

---

Key Highlights

Store-Level Control

Each store maintains its own password policy setting. Administrators can enable the enhanced password policy on a store-by-store basis.

Gradual Rollout

The enhanced policy can be introduced incrementally by enabling the setting on selected stores while maintaining existing behavior on others.

Two-Level Validation

Password validation occurs in two locations:

1. Storefront or Page Builder form validation
2. API validation

The front-end validation provides immediate feedback, while the API validation serves as the final enforcement layer.

Administrator Password Management

Administrative password workflows are not controlled by the store setting.

Administrators always follow the enhanced password policy.

BStore Inheritance

A BStore inherits the Enable Strong Password Policy value from its parent store.

Safe Fallback Behavior

When the store context cannot be determined or no store is available, password validation follows the existing enforcement behavior to ensure password security remains intact.

Error Message Consistency

Existing password validation messages continue to be used wherever applicable. A new validation message is introduced for username and email address checks.

Password Expiration Remains Unchanged

Password expiration behavior is not controlled by the store-level password policy setting. Administrator passwords continue to follow the existing expiration policy of 60 days, and the expiration duration cannot be configured through the Admin Console.

---

Enhanced Password Policy Requirements

When Enable Strong Password Policy is set to Yes, all newly created or modified passwords must meet the following requirements.

Requirement	Value
Minimum Length	12 Characters
Maximum Length	128 Characters
Uppercase Letter	Required
Lowercase Letter	Required
Number	Required
Special Character	Required
Username in Password	Not Allowed
Email Address in Password	Not Allowed

Valid Password Example

MySecure@Password2026

Invalid Password Examples

Password	Reason
Password123	Missing special character
johnsmith123!	Contains username
user@email.com123!	Contains email address

Password validation is case-insensitive when checking for usernames and email addresses. Any variation of the username or email address causes validation to fail.

---

Use Case 1: Configure Strong Password Policy for a Store

Administrators can enable or disable the enhanced password policy at the store level.

Steps

1. Navigate to Stores in the Admin Console.
2. Open the required store.
3. Navigate to Additional Attributes.
4. Locate the Password Policy Setting attribute group.
5. Select Enable Strong Password Policy.
6. Set the value to Yes or No.
7. Save the store configuration.

Expected Outcome

• When set to Yes, Storefront and Page Builder password workflows enforce the enhanced password policy.
• When set to No, Storefront and Page Builder continue using the legacy password policy.
• Administrative password management remains unchanged.

---

Use Case 2: Register a Customer Account on the Storefront

Customer registration validates passwords using the policy configured for the associated store.

Steps

1. Open the registration page on the Storefront.
2. Enter the required registration information.
3. Enter a password that satisfies the active password policy.
4. Submit the registration form.

Expected Outcome

• Registration completes successfully when the password meets the applicable policy requirements.
• Registration is prevented when validation fails.

---

Use Case 3: Create a New User Account

Administrators creating users in supported customer-facing workflows must provide a password that complies with the active password policy.

Steps

1. Navigate to the user creation page.
2. Enter the required user information.
3. Enter a password that satisfies the applicable policy.
4. Save the user record.

Expected Outcome

• The user account is created successfully when validation passes.
• User creation is prevented when password validation fails.

---

Use Case 4: Change an Existing Password

Password changes follow the policy configured for the relevant store.

Steps

1. Navigate to the Change Password page.
2. Enter the current password.
3. Enter a new password.
4. Confirm the new password.
5. Submit the request.

Expected Outcome

• The password is updated successfully when validation passes.
• The password change is rejected when the new password violates policy requirements.

Validation Rules

Field	Validation
Current Password	Required Only
New Password	Password Policy Validation
Confirm Password	Must Match New Password

Existing users with older passwords can still change passwords because only the new password is validated against the active policy.

---

Use Case 5: Reset a Forgotten Password

Forgot Password and Reset Password workflows follow the policy configured for the store.

Steps

1. Initiate the password reset process.
2. Open the password reset page using the reset link.
3. Enter a new password.
4. Confirm the password.
5. Submit the request.

Expected Outcome

• Password reset completes successfully when validation passes.
• Password reset is rejected when the password does not satisfy the active policy requirements.

---

Use Case 6: Administrative Password Management

Administrative user password operations always follow the enhanced password policy.

Supported Functions

• Reset Password
• Reset Administrator Password
• Create User
• Convert Buyer to Administrator
• Commerce Portal User Creation

Expected Outcome

All Administrator-related password workflows consistently enforce the enhanced password policy regardless of store configuration.

---

Password Expiration Notifications

Password expiration notifications are available for Admin Console users.

When the Notification Appears

The notification displays after login when the password expiration date is within seven days.

Notification Message

Your password expires in N days. Please change it soon.

Behavior

• Displays after successful login.
• Appears once after login.
• Does not block access.
• Does not require an immediate password change.
• Existing password expiration policies remain unchanged.
• Administrator passwords expire after 60 days by default.
• The password expiration period cannot be configured through the Admin Console.
• The Enable Strong Password Policy setting does not affect password expiration behavior.

---

Validation Messages

Password Complexity Error

Password must be at least 12 characters long and include uppercase and lowercase letters, at least one number, and at least one special character.

Username or Email Validation Error

Your password must not contain your username or email address.

---

Existing User Impact

Existing users are not required to change current passwords as part of this enhancement.

Unchanged Behavior

• Existing passwords continue to function.
• Login behavior remains unchanged.
• Current password expiration processes remain unchanged.
• Password history enforcement remains unchanged.
• No forced password reset is introduced.

---

Password History Policy

The existing password reuse restriction remains active.

Users cannot reuse any of their previous four passwords.

---

Common Validation Scenarios

Scenario	Result
Password contains username	Rejected
Password contains email address	Rejected
Password contains fewer than 12 characters	Rejected
Password is missing an uppercase letter	Rejected
Password is missing a lowercase letter	Rejected
Password is missing a number	Rejected
Password is missing a special character	Rejected
Password meets all requirements	Accepted

---

Important Notes

• The Enable Strong Password Policy setting applies only to Storefront and Page Builder password workflows.
• The default value for all new and existing stores is No.
• Password validation is enforced both in the user interface and through API validation.
• API validation cannot be bypassed through direct API requests.
• System-generated passwords must comply with the applicable password policy.
• BStores inherit the password policy setting from their parent store.
• Administrative password management always follows the enhanced password policy.
• Password expiration notifications apply only to Admin Console users.
• Administrator passwords expire after 60 days by default.
• The password expiration period cannot be configured through the Admin Console.
• The Enable Strong Password Policy setting controls password complexity requirements only and does not control password expiration settings.
• Existing password history policies remain unchanged.
• When store context cannot be determined, password validation follows the existing enforcement behavior.

---

Related Areas

The password policy enhancement affects the following business processes:

• Storefront Customer Registration
• Buyer Registration
• User Management
• Password Changes
• Password Resets
• Administrative User Creation
• Commerce Portal User Administration
• Password Expiration Notifications
• API-Based Password Operations
• Multi-Store Password Policy Management