Versions Compared

Old Version 2

changes.mady.by.user Jay Hodgson

Saved on

compared with

New Version 3

changes.mady.by.user Ziming Dong

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. User logs in via the POST /login API with a username/password
  2. Check that the user's password is not in our list of known, common passwords.
  3. If it is, still return with HTTP 401 Unauthorized and respond with an ErrorResponse object that contains an errorCode.
  4. Clients, upon seeing the errorCode, should redirect to page for changing password.


Resets should be done via the EmailResetChangePassword  option instead of oldpassword/newpassword so that the old, weak password can't be used to change the account password

API Changes

Currently, our POST /user/password takes

...