Resend user invite email always expired after 72 hours

karltynan commented 1 year ago

Which Umbraco version are you using? (Please write the exact version, example: 10.1.0)

10.7.0

Bug summary

If you invite a user and they do not start or finish the invitation process, the email link expires after 72 hours - this is as expected and is working correctly.

However, if you resend the invitation to the user, the email link is already expired (even within the 72 hours window). Deleting the user and trying the invite process again also yields the same result - the email link is already expired.

Specifics

This happens only for users who have not yet started the invite process, or after deleting a user and trying again.

Steps to reproduce

Invite a user and allow the invite link to expire
Try the link and it should be expired (correct)
After expiry, resend the invitation to the user
Try the link and it is already expired (incorrect)
Delete the user
Invite the same user fresh
Try the link and it is already expired (incorrect)

Expected result / actual result

A user should be able to follow the invitation process within 72 hours of initial invite email
A user should be able to follow the resent invitation process within 72 hours of resent invite email
A previously deleted user should be able to follow the invitation process within 72 hours of new invite email

github-actions[bot] commented 1 year ago

Hi there @karltynan!

Firstly, a big thank you for raising this issue. Every piece of feedback we receive helps us to make Umbraco better.

We really appreciate your patience while we wait for our team to have a look at this but we wanted to let you know that we see this and share with you the plan for what comes next.

We'll assess whether this issue relates to something that has already been fixed in a later version of the release that it has been raised for.
If it's a bug, is it related to a release that we are actively supporting or is it related to a release that's in the end-of-life or security-only phase?
We'll replicate the issue to ensure that the problem is as described.
We'll decide whether the behavior is an issue or if the behavior is intended.

We wish we could work with everyone directly and assess your issue immediately but we're in the fortunate position of having lots of contributions to work with and only a few humans who are able to do it. We are making progress though and in the meantime, we will keep you in the loop and let you know when we have any questions.

Thanks, from your friendly Umbraco GitHub bot :robot: :slightly_smiling_face:

bjarnef commented 1 year ago

I wonder if this also is valid on Umbraco Cloud? I investigated a user invite, where the invitation was expired. I deleted the user invite from the portal and re-sent an user invite from backoffice, which shown up in the portal to expire in ~5 days.

This specific project is on Umbraco v10.5.1

When user state is "Invited", could we shown the Expiration Date at the user info, as shown in Umbraco Cloud portal?

User invite says 72 hours, but doesn't match the user invite expire date shown in the portal.

andr317c commented 1 year ago

Hey,

Thanks for posting this issue. I tried reproducing your issue on version 10.7.0 using SMTP, but when I got to step 4 of your reproduction steps, the invitation link worked and I was able to create the user without any issues. Are you able to reproduce this issue on a clean install of Umbraco?

karltynan commented 1 year ago

Sorry, I have been on annual leave recently. I can check if this works on a clean install, but that will take a little while of course.

The only other thing that might be worth adding is we are using a simple (as per docs) load-balanced setup. Could this have any impact?

karltynan commented 11 months ago

We found the issue (on our setup at least) and we have emailed support to see if we should open a new issue.

We added this in startup.cs, which caused invalid tokens when encoding/decoding:

services.AddRouting(options =>
{
    options.LowercaseUrls = true;
    options.LowercaseQueryStrings = true;
});

Removing options.LowercaseQueryStrings fixed the problem and email invites worked as expected (invites were always working as expected, but the token was invalid so Umbraco thought it was expired).

umbraco / Umbraco-CMS