I have problem using default Apex Application Express Authentication. If user has to change password (no matter if developer or end user), you are unable to login in. Instead of password change window i get error "Forbidden The requested operation is not allowed". If password is valid and not expired or not required to change, you can login successfully. Can't find solution for this problem. Using Apex 20.1, oracle 18c (18.0.0.0.0 ).
Accidentally found problem. All applications share same session (Session Sharing set to Workspace Sharing). This prevents user from being able to change password and login if user needs to change it. So I've went easy way. Created another application without session sharing for users, to be able to change password.