Strict password validation is for registration, change password,
reset password and similar forms. In login form, we don't want
to interrupt user with unnecessary validation as it's completely
irrelevant what they actually entered. The one thing it's about
is the correctness of the email and the password.
Disabling strict validation for password is a kind of security
through obscurity, which could filter some untargeted attempts
for trying passwords by bots. If the bot immediatelly receives
notes about the requirements, it has more imformation for better
attacks.
Alex Holliday
Michal Šmahel
mohadeseh safari
Vishnu Sreekumaran Nair