Add support for /.well-known/change-password

[romainmrhenry]

[Chrome Feature](​https://www.chromestatus.com/feature/6256768407568384)
[Editors Draft](​https://wicg.github.io/change-password-url/)

This already landed in Safari

Would it be possible to add support for /.well-known/change-password into WordPress?

This might redirect to wp_login_url()

[johnbillion]

Note: Some hosts handle routing for the .well-known path internally, meaning that such requests might not ever reach the web server that WordPress is running on. I know for example that SiteGround does this.

[romainmrhenry]

Yes, also read some anecdotes of either hosts or proxies handling all .well-known paths. I personally think this is a bad practice, but unfortunately the [spec](​https://www.rfc-editor.org/rfc/rfc8615.html) does not prohibit this.

[ayeshrajans]

+1 from me. I think it's a really nice addition. I'm not sure redirecting to the login page is the correct approach though. Shouldn't we send the user to wp-admin/profile.php, where the new password field is located? WordPress will take care to redirect the user to the login page with redirect_to parameter set back to wp-admin/profile.php in case the user is not logged in.

[romainmrhenry]

I though about redirecting to wp-admin/profile.php and still consider it a good option.

wp_login_url() might offer more options to theme builders, especially those with custom user flows (ecommerce).

It might need to be a separate thing altogether with a dedicated filter.

[ayeshrajans]

This URL is intended to be used when the user tries to change the password, as in a password manager helping to automatically or semi-automatically change the password. I think a redirect to the profile page is fine, because any custom workflows for user profile would redirect the user from profile page to any custom page anyway.

[pfefferle]

Maybe we should also consider to use the autocomplete attributes:

<input type="password" autocomplete="new-password">

or:

<input type="password" autocomplete="current-password">

for the password field(s).

See: ​https://adactio.com/journal/17794

[johnbillion]

Great point @pfefferle , can you open a separate ticket for this please?

[pfefferle]

Sure!

[pfefferle]

@johnbillion I found this old ticket: https://core.trac.wordpress.org/ticket/49608

Should we re-open it, or should I write a new one with the fokus on autocomplete="current-password"?

[romainmrhenry]

This is now also supported in 1Password and Chrome.
Would be great if we could move forward with this :)

[romainmrhenry]

The specification for this has reached First Public Working Draft : ​https://www.w3.org/TR/2022/WD-change-password-url-20220927/

Who on the WordPress core team can champion this feature?