![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 6 years ago
Last modified 4 hours ago
#51173 new feature request
Add support for /.well-known/change-password
| Reported by: | romainmrhenry | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Future Release |
| Component: | Login and Registration | Version: | |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: |
Description
[Chrome Feature](https://www.chromestatus.com/feature/6256768407568384)
[Editors Draft](https://wicg.github.io/change-password-url/)
This already landed in Safari
Would it be possible to add support for /.well-known/change-password into WordPress?
This might redirect to wp_login_url()
Attachments (1)
Change History (16)
#3
@
6 years ago
Yes, also read some anecdotes of either hosts or proxies handling all .well-known paths. I personally think this is a bad practice, but unfortunately the [spec](https://tools.ietf.org/html/rfc5785) does not prohibit this.
#4
@
6 years ago
- Keywords needs-unit-tests added
+1 from me. I think it's a really nice addition. I'm not sure redirecting to the login page is the correct approach though. Shouldn't we send the user to wp-admin/profile.php, where the new password field is located? WordPress will take care to redirect the user to the login page with redirect_to parameter set back to wp-admin/profile.php in case the user is not logged in.
#5
@
6 years ago
I though about redirecting to wp-admin/profile.php and still consider it a good option.
wp_login_url() might offer more options to theme builders, especially those with custom user flows (ecommerce).
It might need to be a separate thing altogether with a dedicated filter.
#6
@
6 years ago
This URL is intended to be used when the user tries to change the password, as in a password manager helping to automatically or semi-automatically change the password. I think a redirect to the profile page is fine, because any custom workflows for user profile would redirect the user from profile page to any custom page anyway.
#7
@
5 years ago
Maybe we should also consider to use the autocomplete attributes:
<input type="password" autocomplete="new-password">
or:
<input type="password" autocomplete="current-password">
for the password field(s).
#10
@
5 years ago
@johnbillion I found this old ticket: https://core.trac.wordpress.org/ticket/49608
Should we re-open it, or should I write a new one with the fokus on autocomplete="current-password"?
#12
@
5 years ago
This is now also supported in 1Password and Chrome.
Would be great if we could move forward with this :)
#13
@
4 years ago
The specification for this has reached First Public Working Draft : https://www.w3.org/TR/2022/WD-change-password-url-20220927/
Who on the WordPress core team can champion this feature?
This ticket was mentioned in PR #12621 on WordPress/wordpress-develop by @hasnainashfaq.
11 hours ago
#14
- Keywords has-patch has-unit-tests added; needs-unit-tests needs-patch removed
Fixes https://core.trac.wordpress.org/ticket/51173
## What
Adds a redirect from /.well-known/change-password to wp-admin/profile.php inside the existing wp_redirect_admin_locations() function in canonical.php. This follows the W3C Well-Known Change Password URL spec.
## Why
Browsers (Chrome, Safari, Firefox) and password managers use /.well-known/change-password to automatically navigate users to the password-change page. Without this redirect, WordPress sites return a 404 for this URL, breaking password manager integrations.
## How
- Adds
/.well-known/change-passworddetection towp_redirect_admin_locations(), mirroring the existing pattern for/loginand/adminaliases. - Redirects to
admin_url( 'profile.php' )— the profile page handles unauthenticated users by redirecting them to the login page withredirect_toset back to the profile page. - A
wp_change_password_urlfilter allows sites with custom user flows (membership plugins, WooCommerce accounts) to override the redirect target. - Only fires when pretty permalinks are enabled (same guard as the rest of the function).
## Tests
Adds tests/phpunit/tests/canonical/changePassword.php covering:
- Redirect fires for
/.well-known/change-password - Trailing-slash variant does not redirect (consistent with
untrailingslashitbehavior elsewhere) - No redirect when pretty permalinks are disabled
wp_change_password_urlfilter is respected
#15
@
4 hours ago
I've opened a pull request for this: https://github.com/WordPress/wordpress-develop/pull/12621
The implementation adds the redirect inside wp_redirect_admin_locations() in canonical.php, mirroring the existing pattern for /login and /admin. It redirects to admin_url( 'profile.php' ) with a wp_change_password_url filter for custom user flows, and covers subdirectory installs by also matching the root-relative path. Unit tests included.
Note: Some hosts handle routing for the
.well-knownpath internally, meaning that such requests might not ever reach the web server that WordPress is running on. I know for example that SiteGround does this.