I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing:
- Username
- Current Password
- New Password (matching complexity requirements)
- Confirm New Password
Ignoring user experience for the moment, is there anything insecure about this flow IF:
- An identical generic error message is displayed if any of the fields above are invalid on submission
- Password lockouts are enforced after valid username and invalid password are submitted X times.
Is this any more or less secure than the login page itself, and therefore, no additional risk?