IdentityApiEndpointRouteBuilderExtensions should not create the ConfirmationLink
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
The `IdentityApiEndpointRouteBuilderExtensions` should never create a ConfirmationLink but must be dealing with codes only.
When we see the implementation of `IEmailSender`
We see `SendConfirmationLinkAsync`, `SendPasswordResetCodeAsync` and `SendPasswordResetLinkAsync`
Here the `SendPasswordResetLinkAsync` and the `SendConfirmationLinkAsync` should be removed and a `SendConfirmationCodeAsync` should be added.
The `SendPasswordResetCodeAsync` is used in the ApiEndpoint but `SendPasswordResetLinkAsync` is never used in the Api.
Only in the UI implementation.
When we want to generate a link instead of using the code, we should generating the link inside the `IEmailSender` implementation.
So only `SendConfirmationCodeAsync` and `SendPasswordResetCodeAsync` sould be sufficient in the `IEmailSender` interface
**IdentityApiEndpointRouteBuilderExtensions.cs**
https://github.com/dotnet/aspnetcore/blob/65f485e825c60908e1c6496dd59b981a54d2ab0e/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs#L214-L217
**ForgotPassword.cshtml.cs**
https://github.com/dotnet/aspnetcore/blob/65f485e825c60908e1c6496dd59b981a54d2ab0e/src/Identity/UI/src/Areas/Identity/Pages/V5/Account/ForgotPassword.cshtml.cs#L75-L83
The ForgotPassword.cshtml.cs should also be using the `SendPasswordResetCodeAsync` inside the implementation of the emailsender we sould generate the callbackUrl.
Contributor guide
Assessment
This issue has not been assessed yet.