Steps to reproduce the issue

Joomla 4.0-dev - install as standard with no sample data

For example. My test case credentials are u: admin p: admin (5 chars, meets current 4 char minimums)

Login as an admin in /administrator/
Manage Users -> Options -> Set Password Min Length to something higher, lets say 10 -> Save - the Joomla minimum password length is now 10 chars.

visit http://example.com/index.php?option=com_users&view=login

You will now see a login page, and a login module.

View the source of the password field in the PAGE (not the right module, we will come to that in a moment)

[Linebreaks mine to make it clearer in GitHub]

<input type="password" name="password" id="password" 
value="" autocomplete="current-password" 
class="form-control validate-password required" size="25" maxlength="99" 
required="" data-min-length="10"
>

note the data-min-length="10" attribute!

Ok now watch, Im entering one char at a time and then blur by clicking out of the password box

Note that it only takes FOUR chars before it accepts the input, instead of the expected 10 chars set in admin and set by the data-min-length

Next lets look at the password field in the MODULE on the right, note the html is

<input id="modlgn-passwd-16" type="password" name="password" autocomplete="current-password" class="form-control" placeholder="Password">

Note there is NO data-min-length="10" attribute!

Note that this password field (in the module) DOESNT need 4 chars as there is no annoying javascript validation on it at all.

Just a quick check -

• the login page at /administrator/ doesnt have the data-min-length="10" attribute either
• the login page at /administrator/ doesnt have the annoying 4 char minimum input for validation either

Expected result

1. Both password fields should have the data-min-length="10" attribute - or neither should - if its there then I assume its for the passwordstrength JS which doesnt appear to even be running on this page.

2. if the min length configured is 10 then the field should not be accepting just 4 to validate

3. Is showing the minimum char of a password a security issue? it gives away an important figure to brute forcers? I dont know, lets tag @joomla/security @SniperSister and the JSST can decide.

Personally, and my opinion is not important, I think the correct course of action is to remove ALL Javascript validation from the password field (and username field!), and to remove the data-min-length attribute from all frontend password fields.

Actual result

Described in narrative above.

System information (as much as possible)

Safari on Mac.

Additional comments

No console errors.