Creative usernames and Spotify account hijacking

This post details a critical security incident where account hijacking was possible due to a non-idempotent username canonicalization process. The vulnerability stemmed from the XMPP nodeprep implementation not correctly handling Unicode characters outside of Unicode 3.2, leading to discrepancies between verbatim and canonical usernames. The fix involved a wrapper function to ensure idempotency and a temporary restriction on username registration until a more permanent solution was implemented. The root cause was traced back to a change in Python's standard library `unicodedata` module between versions 2.4 and 2.5, which affected the Twisted library's implementation.