I couldn't replicate the failure... I've also tried it on local and wikibase.dev and so far they all worked.

So actually task-specific email addresses (one with + in it) caused the problem. Password resetting email was sent and new password was created but somehow I can still login with the old password and even create a new wiki.

"POST /user/resetPassword HTTP/1.1" 422 517 "http://www.wbaas.localhost/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"

The POST request send to the api to reset the password was 422: The request was well-formed but was unable to be followed due to semantic errors. That's why the old password is still usable due to the fact that the HTTP request to reset password didn't work.

@dang The user has agreed to change their email by excluding the +task part. Everything else remains the same.

Option 2: Fix api to work with task-specific emails

I would strongly prefer this option for anything other than a short-term fix. Many providers now allow "+" mail-addresses and we are going to have more of these in the future.

I'm trying to go with option 2.

WIP PR. I'm still trying to write a test for this case

https://github.com/wbstack/api/pull/481

Tested and verified, works perfectly @dang

@Evelien_WMDE: The project tag got archived and this open task has no other active project tags. Could you please either add an active project tag so this task can be found, or update the task status? Thanks a lot!