in app/Attribute/EnforceChangePasswordAttribute.cs [11:17]
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
var userManager = filterContext.HttpContext.RequestServices.GetService<UserManager<AppUser>>();
var user = userManager?.GetUserAsync(filterContext.HttpContext.User).GetAwaiter().GetResult();
if (user is {EnforceChangePassword: true})
filterContext.Result = new RedirectResult("/Account/SetPassword");
}