I've been trying to answer the following question but can't seem to find a clear answer...

> 
> When a user resets their password after forgetting it, should they be allowed to change it to the password that it's already set to?
> 
> 
> 

I understand that the whole reason behind the user resetting their password is they forgot it, but in terms of security, wouldn't it make sense to have them change to a different password? In the [Forgot Password Cheat Sheet](https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet) and [Authentication Cheat Sheet](https://www.owasp.org/index.php/Authentication_Cheat_Sheet), I can't find any mention of reusing old passwords. 

If this rule should be used, would this be a proper error message for it?

> 
> Password must be different than the existing one.
> 
> 
>