One of the funnier versions of this that I ran into was on Instacart’s change password form. Years ago, they allowed very weak passwords. Eventually they imple

One of the funnier versions of this that I ran into was on Instacart’s change password form. Years ago, they allowed very weak passwords. Eventually they implemented a complexity policy that required longer passwords, symbols etc. They applied client side validation of the complexity rules on their password change form, but they also applied the rules to the existing password. I ended up having to use burp suite to change the request inflight so as to set the correct current password.