The /users/password/reset endpoint in application/backend/src/controllers/UsersController.ts doesn't check whether the new password matches the user's current one (or any previous). No password history tracking exists in the schema.
Modern NIST guidance actually leans AWAY from forced password history checks, since users end up iterating predictably
(Password1 -> Password2 -> Password3 etc.) which weakens rather than strengthens security.
Filing as a question - worth a quick team decision on whether we want history enforcement in the health context, or whether following the modern NIST guidance and leaving it as-is is fine.
The
/users/password/resetendpoint inapplication/backend/src/controllers/UsersController.tsdoesn't check whether the new password matches the user's current one (or any previous). No password history tracking exists in the schema.Modern NIST guidance actually leans AWAY from forced password history checks, since users end up iterating predictably
(Password1 -> Password2 -> Password3 etc.) which weakens rather than strengthens security.
Filing as a
question- worth a quick team decision on whether we want history enforcement in the health context, or whether following the modern NIST guidance and leaving it as-is is fine.