[TheNightmanCodeth]

Overall Checklist

• I agree to the project's Developer Certificate of Origin
• There are no open pull requests for the same update

for password-rules.json

• The given rule isn't particularly standard and obvious for password managers
• Generated passwords have been tested from this rule using the Password Rules Validation Tool
• Information has been included about the website's requirements (eg. screenshots, error messages, steps during experimentation, etc.)
• The PR isn't documenting something that would be a common practice among password managers (e.g. minimal length of 6)

for change-password-URLs.json

• There is no Well-Known URL for Changing Passwords (https://example.com/.well-known/change-password)
• The URL either makes the experience better or no worse than being directed to just the domain in a non-logged-in state

---

Summary

Pilot Flying J moved its web presence from pilotflyingj.com to pilotcompany.com; pilotflyingj.com now 301-redirects to https://pilotcompany.com. The existing quirks are stale.

Changes

• change-password-URLs.json
  • pilotflyingj.com: replaced the dead https://portal.pilotflyingj.com/myrewards/forgot-password (now 301s to a login page) with https://pilotcompany.com/api/auth/reset-password.
  • Added pilotcompany.com with the same URL.
• password-rules.json
  • pilotflyingj.com: minlength: 7; required: digit; allowed: lower, upper; -> minlength: 8; required: lower; required: upper; required: digit; required: [-#$%&*?^];
  • Added pilotcompany.com with the same rule.

Evidence

No well-known URL (checked with curl):

• https://pilotcompany.com/.well-known/change-password -> 404 (identical to a nonexistent path)
• https://pilotflyingj.com/.well-known/change-password -> 301 -> https://pilotcompany.com

Change password URL: this is the target of the "Forgot Password" link on the sign-in page. It 302s to PingOne's password-reset authorize flow (auth.pingone.com). The link carries a ?x-a-v=1 query parameter; the response is identical without it, so it was dropped.

Password rules: the reset form lists these requirements:

• At least 8 characters
• Upper and lowercase letters
• At least 1 special character (#?$%^&*-)
• At least 1 number

The form's client-side validation enforces this with:

value.length >= 8
/[a-z]/.test(value) && /[A-Z]/.test(value)
/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]+/.test(value)
/\d/.test(value)

The rule requires a special character from the set the site lists on the form, which is a subset of what the validator accepts, so generated passwords are always accepted.

I used the Password Rules Validation Tool to generate 10000 passwords and put them all through the client-side validation script from the site itself.

[rmondello]

Pilot Flying J moved its web presence from pilotflyingj.com to pilotcompany.com; pilotflyingj.com now 301-redirects to https://pilotcompany.com. The existing quirks are stale.

@TheNightmanCodeth Should we also then add a from-to redirect quirk in shared-credentials.json from pilotflyingj.com to pilotcompany.com and also drop pilotflyingj.com from password-rules.json, because that domain will no longer generate passwords?