Hi,

I am trying to enforce the following password strength rules:

8 characters minimum
including at least 2 digits
and at least one non-alphanumeric character

Web.config fragment:

 <membership defaultProvider="XYZMembershipProvider">
  <providers>
       <add name="XYZMembershipProvider"
       connectionStringName="XYZMembershipConnection"
       applicationName="XYZ"
       passwordStrengthRegularExpression="(?=.{8,})(?=(.*\d){2,})(?=(.*\W){1,})"
       enablePasswordReset="false"
       requiresUniqueEmail="true"
       passwordFormat="Hashed"
       type="System.Web.Security.SqlMembershipProvider"/>
  </providers>
 </membership>

On provider level it works fine, but when I'm trying to place the same Regex
(?=.{8,})(?=(.*\d){2,})(?=(.*\W){1,})
into NewPasswordRegularExpression property of ChangePassword control,
client-side validation fails for valid passwords that pass server-side
validation when NewPasswordRegularExpression is not filled.

Control markup is below. It looks like javascript-based regex parsing does
not work the same way as its client side peer. Any suggestions?

   <asp:ChangePassword ID="ChangePassword1" runat="server"
       NewPasswordRegularExpressionErrorMessage="New password must have at
least 8 characters, including two numbers and one special character"
       PasswordHintText="Please enter a password at least 8 characters
long, containing two numbers and one special character"
       NewPasswordRegularExpression="(?=.{8,})(?=(.*\d){2,})(?=(.*\w){1,})">
   </asp:ChangePassword>

Regards,
Dmitry