Re: Proposal:

I don't have a strong opinion about this, but have any existing password
managers or websites given you feedback about how they'd use this proposal?
For example, LastPass has an "Auto Change Password" option. Would this be
enough to help that work in more cases, or do they need something more
structured at the endpoint?


On Tue, Apr 3, 2018 at 4:32 PM John Wilander <> wrote:

> Hi WebAppSec!
> We’re thinking of proposing a well-known URL location where users can
> change their password or other credentials. Since this working group owns
> the Credential Management spec, we’d like to get your feedback before we
> email
> # The problem
> When a password/credential manager wants to facilitate a user updating
> their credentials, there isn't a good way to determine which part of the
> relevant website to send the user to or to signal to the website that the
> user's intent is to modify their credentials.
> # The proposal
> as a well-known URL
> endpoint that signals user intent to modify their credentials. The web
> server can serve a page at this location or do an HTTP or client-side
> redirect. The location should be restricted to HTTPS, including any
> redirects. RFC5785 doesn’t mention scheme restrictions but hopefully we can
> work that out with the reviewers.
> What are your thoughts?
>    Regards, John

Received on Wednesday, 4 April 2018 03:46:21 UTC