Microsoft Edge and forgotten password failure

What version of UAA are you running?

4.35

How are you deploying the UAA?

I am deploying the UAA

• using cf-deployment

What did you do?

Triggered the forgotten password flow by using the link on UAA. This was then opened by Microsoft Edge (system default browser). This loads the password reset page as expected.

What did you expect to see? What goal are you trying to achieve with the UAA?

I expected to see that the password which met the complexity requirements was accepted.

What did you see instead?

The following error message

There is a problem “Invalid login attempt, the request does not meet our security standards and may indicate that the action was not originated by you. Please try again.”

Additional info

We have no issues with Chrome, Firefox, Safari. Just with Edge. Unfortunately some of our users are on Enterprise managed Windows estates and are unable to change browsers. Once the password has been reset normal functionality continues with Edge.

Start by reproducing the forgotten-password flow in Microsoft Edge using UAA 4.35 with cf-deployment, then compare it with Chrome, Firefox, and Safari. Trace the password-reset request and security validation to identify why Edge is rejected despite a compliant password. Done means Edge completes the reset successfully without regressing the other browsers.