Who supports this?

[marcoscaceres]

Hi, WICG chairs are just going through the repos and checking status... I seem to recall Safari supports this feature (and twitter was using it, right?)? Did other browser vendors get behind it? If yes, should we consider moving it to the W3C or WHATWG?

[tschoffelen]

I think there's quite a lot of websites that implement this now (including Facebook and Twitter), and a few password managers and browsers make use of this spec (Safari, 1Password).

[marcoscaceres]

Great to hear that big sites are using it. What about other browsers?

[battre]

Chrome is generally interested in this, but we have some concerns about the reliability that we haven't quantified, yet.

We see for example servers responding with "200 OK" and a page that says "this page does not exist" or that does not have a login form when you are logged out. I would consider to add a mandatory header that says "Server understands this spec, my HTTP response code is reliable".

To pick on ourselves instead of others: https://news.google.com/.well-known/change-password redirects me to https://news.google.com/?hl=de&gl=DE&ceid=DE:de.

Also there is no commitment on any timeline from our side, yet.

[tschoffelen]

@battre Yep, that's something that others realised as well: #14

[hober]

@battre wrote:

Chrome is generally interested in this, but we have some concerns about the reliability that we haven't quantified, yet.

We see for example servers responding with "200 OK" and a page that says "this page does not exist" or that does not have a login form when you are logged out.

Yeah, we've seen this too, and like @tschoffelen points out, it came up before in #14. In that issue, we concluded that a separate well-known URL would be best for detecting this, and in 0b98642 I've defined such a mechanism in a separate document in this repository. Please let me know what you think.

[hober]

@battre, any thoughts?

[battre]

The proposal in https://wicg.github.io/change-password-url/response-code-reliability.html makes sense to me and this is what we are currently implementing.

[marcoscaceres]

Thanks for the update @battre ... checking if there is interest from the Gecko side.

[marcoscaceres]

Filed mozilla/standards-positions#372 for a Mozilla position.