Hey there! I'm using Umbraco 12 and I wanted to provide a "forgot password" mechanism to frontend members. I'm currently asking for the e-mail to get the MemberIdentityUser member and then using the MemberManager.GeneratePasswordResetTokenAsync(member) to get the token. I then encode it and send the e-mail with the encoded token. After clicking the link in the e-mail, a controller is called with the encoded token and the user. A token validation is performed using MemberManager.VerifyUserTokenAsync(member, _options.Tokens.PasswordResetTokenProvider, UserManager.ResetPasswordTokenPurpose, token) I've also tried MemberManager.VerifyUserTokenAsync(member, "Default", "ResetPassword", token) Both return false. I've debugged it and can confirm the token sent (before encoding) matches the received token. What am I missing here? Thank you 🙂

Hi there! Just to be sure: you say you encoded your token, but do you also need to decode it before you call

VerifyUserTokenAsync

?

I assume you're not calling ResetPasswordAsync before you're verifying the token?

In your Startup.cs - ConfigureServices(IServiceCollection services) method, ensure that: services.AddAuthentication Appears BEFORE services.AddIdentity

I do not need to decode it, the controller does (I've checked the token before encoding and when it gets to the controller and it matches)

doesn't look like it for 12. In my reset code I use the changepassword method and pass it the token, I don't check it first

cs
var changePasswordResult =
    await _memberManager.ChangePasswordWithResetAsync(user.Id, token, changePassword.Password);

Well, I was hoping to check the token before showing the form to the user, but oh well 😦

When you generate the token, you could store it on the member record and check that matches the token instead

Well, the tokens should have a expire date (which I believe to be 24h default) and the token storage in member's record would not have that info (I know I could code it as well, but I think the VerifyUserTokenAsync should be doing). I'll ignore this step for the time being and open a bug report. Thank you all for your inputs 🙂

this will tell you it has expired or not ChangePasswordWithResetAsync(user.Id, token, changePassword.Password);