Remove change password URLs for sites that now serve /.well-known/change-password - #1210
Merged
aabosh merged 2 commits intoSep 10, 2026
Merged
Conversation
…nge-password The README states that if a website adopts the Well Known URL for Changing Passwords, it should be removed from quirks/change-password-URLs.json. These eight sites have adopted it, so their quirks are now redundant. Each was verified two ways, per the spec's recommended detection procedure: 1. GET https://<domain>/.well-known/change-password returns a redirect to a password management page. 2. GET https://<domain>/.well-known/resource-that-should-not-exist-whose-status-code-should-not-be-200 returns 404, confirming the site returns real 404s and that the redirect in step 1 is therefore trustworthy rather than a catch-all. Results (all sentinel requests returned 404): fetlife.com 301 -> https://fetlife.com/settings/account/password genius.com 301 -> https://genius.com/account/settings#password github.com 301 -> https://github.com/settings/security quizlet.com 308 -> https://quizlet.com/forgotten/password redirect.pizza 302 -> https://redirect.pizza/profile vimeo.com 301 -> http://vimeo.com/settings/account/password wise.com 301 -> https://wise.com/user/settings wordpress.com 301 -> https://wordpress.com/me/security Three notes for reviewers, in case any of these should be kept: - quizlet.com advertises a password reset flow (/forgotten/password) rather than an authenticated change password page. That is Quizlet's own declaration, but it is less direct than the removed quirk (/settings). - wise.com advertises /user/settings, which is less specific than the removed quirk (/your-account/security-and-privacy/change-password). - vimeo.com's Location header uses the http scheme; it upgrades to https on the follow-up request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
aabosh
requested changes
Aug 24, 2026
aabosh
left a comment
aabosh
left a comment
Collaborator
There was a problem hiding this comment.
This seems reasonable to me. Thanks for the contribution!
Can we keep the quizlet.com and wise.com entries? It's okay to keep quirks for websites where the quirk delivers a better experience compared to the implemented well known URL.
Both sites advertise a well known URL that is less direct than the existing quirk: quizlet.com redirects to a password reset flow and wise.com to a generic settings page. Per review feedback, keep quirks where they deliver a better experience than the well known URL. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
aabosh
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The README states that if a website adopts the Well Known URL for Changing Passwords, it should be removed from
quirks/change-password-URLs.json. These six sites have adopted it, so their quirks are now redundant.Verification
Each domain was checked two ways, following the spec's recommended detection procedure:
GET https://<domain>/.well-known/change-passwordreturns a redirect to a password management page.GET https://<domain>/.well-known/resource-that-should-not-exist-whose-status-code-should-not-be-200returns 404, confirming the site returns real 404s and that the redirect in step 1 is therefore trustworthy rather than a catch-all.All six sentinel requests returned 404.
/.well-known/change-password301→https://fetlife.com/settings/account/password301→https://genius.com/account/settings#password301→https://github.com/settings/security302→https://redirect.pizza/profile301→http://vimeo.com/settings/account/password301→https://wordpress.com/me/securityNotes for reviewers
Per @aabosh's review, the
quizlet.comandwise.comquirks are kept, since each delivers a better experience than the well known URL the site advertises:308→https://quizlet.com/forgotten/password) rather than an authenticated change password page. The kept quirk (https://quizlet.com/settings) is more direct./user/settings(301), which is less specific than the kept quirk (https://wise.com/your-account/security-and-privacy/change-password).One remaining note on the sites that are removed:
Locationheader uses thehttpscheme; it upgrades tohttpson the follow-up request.🤖 Generated with Claude Code