cornflourblue / aspnet-core-3-signup-verification-api

ASP.NET Core 3.1 - Boilerplate API with Email Sign Up, Verification, Authentication & Forgot Password
https://jasonwatmore.com/post/2020/07/06/aspnet-core-3-boilerplate-api-with-email-sign-up-verification-authentication-forgot-password
MIT License
226 stars 93 forks source link

/accounts/forgot-password fails after clicking email link. #15

Open jaybo opened 3 years ago

jaybo commented 3 years ago

I'm unable to get the forgot-password flow to work. The email is correctly issued, but after clicking on the email link things go awry.

Similar to issue #13, the ValidateResetToken method needs to be [HttpGet] instead of Post. Additionally, the ValidateResetTokenRequest needs to be extracted from the querystring, so line 83ish in AccountsController.cs should be:

        [HttpGet("validate-reset-token")]
        public IActionResult ValidateResetToken([FromQuery] ValidateResetTokenRequest model)

instead of:

        [HttpPost("validate-reset-token")]
        public IActionResult ValidateResetToken(ValidateResetTokenRequest model)

Also the link in sendPasswordResetEmail (AccountServices.cs, line 374ish) needs to be changed to use validate-reset-token instead of reset-password:

        private void sendPasswordResetEmail(Account account, string origin)
        {
            string message;
            if (!string.IsNullOrEmpty(origin))
            {
                var resetUrl = $"{origin}/api/v1/accounts/validate-reset-token?token={account.ResetToken}";

instead of:

        private void sendPasswordResetEmail(Account account, string origin)
        {
            string message;
            if (!string.IsNullOrEmpty(origin))
            {
                var resetUrl = $"{origin}/api/v1/accounts/reset-password?token={account.ResetToken}";