-
Notifications
You must be signed in to change notification settings - Fork 10.5k
Closed
Labels
DoneThis issue has been fixedThis issue has been fixedarea-identityIncludes: Identity and providersIncludes: Identity and providers
Milestone
Description
Describe the bug
The Identity scaffold template has several ways to trigger the email verification, but one is missing encoding.
.../V3/Account/Login.cshtml.cs
OnPostSendVerificationEmailAsync()
...
var code = await _userManager.GenerateEmailConfirmationTokenAsync(user);
//Missing
code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
//End Missing
var callbackUrl = Url.Page(
Verification process will always decode, so un-encoded links will fail.
To Reproduce
Steps to reproduce the behavior:
- Using this version of ASP.NET Core 3
- Create project with local account storage
- Scaffold Identity
- Implement IEmailSender
- Create Account
- Logout
- Use Resend Verification Email from login page
- Follow link in second email - it will fail.
- Follow link in first email - it will succeed.
Expected behavior
All email verification links to be encoded for email, then decoded on submit.
Metadata
Metadata
Assignees
Labels
DoneThis issue has been fixedThis issue has been fixedarea-identityIncludes: Identity and providersIncludes: Identity and providers