I found yesterday that I was unable to log in. I went through the reset flow, and was still unable to log in with a new password. After some experimentation, I believe it's an issue with how you're escaping it on the server side - a user can set a "properly" complex password in the reset screen, and all seems well, but then the user cannot log in.

Here's the password that I tried that exhibits this behavior:

I didn't try to narrow down the issue to see if it's a problem with length or one or more of the individual characters. The password that I set that works is 10 characters, alphanumeric.

@Goatboy

The exclamation point as the first character would give me pause.

Don't use special characters in passwords.  That's a big no-no almost all the time.

Letters and numbers.  Stick to those.

Since when? Virtually every password I use- except for this site- has to have a special character.

Exactly, my last job and this one now, require 8 Character minimum, 1 Lower, 1Upper, 1 Number, 1 Special , something like  L@rueT@ctical1776!

try not using the % sign

Thanks.

I also don’t believe that verbiage is on the “reset password” page.

As a developer with a focus on security... bullshit. The longer and more complex the better.

If I really wanted to be an ass, I’d put some non-printable Unicode characters in there!