Add support for RFC5785 change password well known resource

Thanks for creating the issue and the patch. The patch looks good. Just two observations:

1. The route name should be user.well-known.change_password
2. The redirect code should be 301.

Thanks for addressing the feedback. Please also create the interdiff for easy reviews.

+++ b/core/modules/user/src/Controller/UserController.php
@@ -259,7 +259,22 @@ public function resetPassLogin($uid, $timestamp, $hash) {
-    return $this->redirect('entity.user.canonical', ['user' => $this->currentUser()->id()]);
+    return $this->redirect('entity.user.canonical', ['user' => $this->currentUser()->id()], [], 301);
...
+    return $this->redirect('entity.user.edit_form', ['user' => $this->currentUser()->id()]);

I think you changed the wrong line.

Hope it hepls.Thanks

Thanks, for addressing the feedback. This looks good now. Let's add a change record and "Release notes snippet". I think it is worth mentioning in the next release notes.

Thanks, for that.

This is a sweet little patch! Thanks!

One question I had was... when reviewing the spec document that this repo links to (https://wicg.github.io/change-password-url/index.html), I notice the following:

It is not a W3C Standard nor is it on the W3C Standards Track.

I guess that is my only real concern, is if we were to commit this, and later this does go on the standards track, but the recommended URL changes, then we'd be kinda stuck with this legacy URL to support. So from that POV, the safest thing to do may be to postpone it until it does become part of the standards.

Are you able to provide additional context as to where this recommendation came from, and/or the likelihood of it getting adopted more "formally" by the W3C?

Hi! @webchick, thanks, for looking into it. I think creating the issue for this is the right way to go so thanks for that @nicksanta. Marking it postpone for now.

Here is the reply from one of the collaborator:

It's very unlikely that the URL would change at this point. If we end up changing the scope of the work sufficiently to call for another endpoint, it'll be in addition to, not instead of, this existing URL.

I think the above addresses @webchick's concerns so setting it back to RTBC.

issue credits

published change record

Committed 3b6f89b and pushed to 8.8.x. Thanks!

Switching tag to highlights since this is cool but isn't disruptive :)