Class LocalBlocklistCompromisedPasswordChecker

java.lang.Object

com.svenruppert.jsentinel.credential.compromised.LocalBlocklistCompromisedPasswordChecker

All Implemented Interfaces:

CompromisedPasswordChecker

public final class LocalBlocklistCompromisedPasswordChecker
extends Object
implements CompromisedPasswordChecker

Offline CompromisedPasswordChecker backed by an operator- supplied blocklist.

The list is normalised at construction time (case-folded, trimmed) and held in a Set of strings. The blocklist exists only in memory — never logged, never serialised. Lookup is case-insensitive to match the NIST guidance that case variants of a known-bad password are themselves bad.

This implementation copies the candidate password into a temporary lower-cased String for the Set.contains(Object) call and does not retain it. Callers that consider this trade-off unacceptable can wrap with their own hash-only blocklist.

Constructor Summary

Constructors

Constructor	Description
LocalBlocklistCompromisedPasswordChecker(Collection<String> entries)

Method Summary

Modifier and Type	Method	Description
CompromisedPasswordResult	check(SecretValue password)	Evaluates the candidate password.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

LocalBlocklistCompromisedPasswordChecker

public LocalBlocklistCompromisedPasswordChecker(Collection<String> entries)

Parameters:

entries - blocklist entries; each is trimmed and lower-cased. Blank entries are skipped.

Method Details

check

public CompromisedPasswordResult check(SecretValue password)

Description copied from interface: CompromisedPasswordChecker

Evaluates the candidate password.

Specified by:

check in interface CompromisedPasswordChecker

Parameters:

password - caller-owned secret. The implementation must not modify it, log it, or hold a reference past the call.

Returns:

CompromisedPasswordResult.Clean when the password is not known to be breached, CompromisedPasswordResult.Pwned when it matches a known entry, or CompromisedPasswordResult.CheckFailed when no verdict could be produced.