dotnet / dotnet/aspnetcore

IdentityApiEndpointRouteBuilderExtensions should not create the ConfirmationLink

Open
#60,195 3 comments 0 reactions 0 assignees View on GitHub
area-identity enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

The `IdentityApiEndpointRouteBuilderExtensions` should never create a ConfirmationLink but must be dealing with codes only.

When we see the implementation of `IEmailSender`
We see `SendConfirmationLinkAsync`, `SendPasswordResetCodeAsync` and `SendPasswordResetLinkAsync`

Here the `SendPasswordResetLinkAsync` and the `SendConfirmationLinkAsync` should be removed and a `SendConfirmationCodeAsync` should be added.

The `SendPasswordResetCodeAsync` is used in the ApiEndpoint but `SendPasswordResetLinkAsync` is never used in the Api.
Only in the UI implementation.

When we want to generate a link instead of using the code, we should generating the link inside the `IEmailSender` implementation.

So only `SendConfirmationCodeAsync` and `SendPasswordResetCodeAsync` sould be sufficient in the `IEmailSender` interface

**IdentityApiEndpointRouteBuilderExtensions.cs**
https://github.com/dotnet/aspnetcore/blob/65f485e825c60908e1c6496dd59b981a54d2ab0e/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs#L214-L217

**ForgotPassword.cshtml.cs**
https://github.com/dotnet/aspnetcore/blob/65f485e825c60908e1c6496dd59b981a54d2ab0e/src/Identity/UI/src/Areas/Identity/Pages/V5/Account/ForgotPassword.cshtml.cs#L75-L83

The ForgotPassword.cshtml.cs should also be using the `SendPasswordResetCodeAsync` inside the implementation of the emailsender we sould generate the callbackUrl.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.