Have you manually created a flow that sends a token and validates the send token?

I'm not sure what your problem is since you did not add any additional information. But what I do know is that by default the password reset functionality won't work unless you set a value in the web.config.

Have you set an UmbracoMembershipProvider in the web.config?

The value allowManuallyChangingPassword must be set to true.

        <membership defaultProvider="UmbracoMembershipProvider" userIsOnlineTimeWindow="15">
        <providers>
            <clear />
            <add name="UmbracoMembershipProvider" type="Umbraco.Web.Security.Providers.MembersMembershipProvider, Umbraco.Web" minRequiredNonalphanumericCharacters="0" minRequiredPasswordLength="10" useLegacyEncoding="false" enablePasswordRetrieval="false" enablePasswordReset="false" requiresQuestionAndAnswer="false" defaultMemberTypeAlias="Member" passwordFormat="Hashed" allowManuallyChangingPassword="true" />
            <add name="UsersMembershipProvider" type="Umbraco.Web.Security.Providers.UsersMembershipProvider, Umbraco.Web" />
        </providers>

I am working in version 9. I haven't got a web.config file.

The membership commands differs a lot in the .NET Core version.

Thank you for showing me that configuration. It did not help med though. I have found a workaround using the PasswordChanger class. I have to compare the token before changing password

var changingPasswordModel = new Umbraco.Cms.Core.Models.ChangingPasswordModel()
{
   Id = id,
   NewPassword = requestNewPassword.Password,
   OldPassword = null
};

var changePasswordResult = await _passwordChanger.ChangePasswordWithIdentityAsync(changingPasswordModel, _memberManager);

Just stumbled on this now. Looking at your original code, I am wondering if you were using the correct token generator method. In your code you use:

string token = await _memberManager.GenerateEmailConfirmationTokenAsync(member);

Have you tried:

var token = await _memberManager.GeneratePasswordResetTokenAsync(user);
var encodedToken = !string.IsNullOrEmpty(token) ? HttpUtility.UrlEncode(token) : string.Empty;

The password reset token generator is probably what you are after. Additionally, you will need to encode the token so it survives the trip back to your change password page. For some reason, the token does not get generated as encoded. Note that you probably don't have to decode it again on the way back in. Hope that helps...

Cheers,

Jamie

I tried GenerateEmailConfirmationTokenAsync()as well, but then got Invalid Token error later when using ChangePasswordWithResetAsync()

var memberIdentity = await _memberManager.FindByEmailAsync(model.EmailAddress);
//string token = await _memberManager.GenerateEmailConfirmationTokenAsync(memberIdentity);
string token = await _memberManager.GeneratePasswordResetTokenAsync(memberIdentity);

It works as expected when using GeneratePasswordResetTokenAsync() though.

Later a new password if set from previous generated token.

var memberIdentity = await _memberManager.FindByIdAsync(model.UserId);
var result = await _memberManager.ChangePasswordWithResetAsync(memberIdentity.Id, token, model.Password);

Not sure if the GenerateEmailConfirmationTokenAsync() shouldn't be used for members as I tried a similar approach the user password reset works in backoffice: https://github.com/umbraco/Umbraco-CMS/blob/26d83381f24fa5b11d1564e283660be31e07f82b/src/Umbraco.Web.BackOffice/Controllers/UsersController.cs#L572-L580

This definitely works for members. Make sure you encode the token in the email outbound. But don’t unencode the token on the way back in. For some reason you don’t need to unencode it.

But email confirmation tokens are for validating/ confirming email addresses, not for resetting passwords. Two different methods for different purposes. For example after a member registers you want to check if there email is legit, you send them an email confirmation token. On the way back in you set email confirmed = true. Then you can test against that and approve their account at that point. Sorry I am on mobile but can post some examples later.

@bjarne When you fetch the member to change the password later using ChangePasswordWithResetAsync, I assume the inviteToken containing the member id at the start (before the | prefix) is used. What prevents someone from changing that id number in the URL and using the link to reset someone elses password?

@Gareth, The token that is generated by GeneratePasswordResetTokenAsync() is unique to that user. If a different id or email is used against that token, the change password operations will fail.

Cheers,

Jamie

is working on a reply...