I've been trying to answer the following question but can't seem to find a clear answer...
When a user resets their password after forgetting it, should they be allowed to change it to the password that it's already set to?
I understand that the whole reason behind the user resetting their password is they forgot it, but in terms of security, wouldn't it make sense to have them change to a different password? In the Forgot Password Cheat Sheet and Authentication Cheat Sheet, I can't find any mention of reusing old passwords.
If this rule should be used, would this be a proper error message for it?
Password must be different than the existing one.