How to implement correctly Reset Password at ASP.NET Core and Angular

Viewed 1879

I'm trying to implement my password recovery to the user who entered his email.

My problem is: I don't know how it should work exactly, I can send email successfully, but the link sent to him need to be a link to the recovery page with his token at the url I assume?

I need to know how I involve the url with my Angular site...

In my code I'm sending a link to the user with the link but I think its need to be after the user get to the page with the password change.

Here's my code:

// Post Request
// POST : /api/AppUser/Login
#region Recover Password
[HttpPost]
[Route("RecoverPassword")]
public async Task<IActionResult> RecoverPassword(RecoverPasswordModel model)
{
        var user = await _userService.FindByEmail(model.Email);
        string code = await _userService.GetRecoveryToken(user);

        string recoveryLink = Url.Action("RecoveryLink", "AppUser", new
        {
            UserId = user.Id,
            Code = code
        }, protocol: HttpContext.Request.Scheme);

        bool finalRes = _userService.SendEmail(user, confirmationTokenLink);

        if (finalRes)
            return Ok();
        else
            return BadRequest(new { message = "No such user with this email" });
}

[HttpGet("[action]")]
[AllowAnonymous]
public async Task<IActionResult> RecoveryLink(string userId, string code, string newPassword)
{
            if (string.IsNullOrEmpty(userId) || string.IsNullOrEmpty(code))
                return BadRequest(new { message = "Code or ID in empty" });

            var user = await _userService.FindByID(userId);

            if (user == null)
                return BadRequest(new { message = "User not found!" });

            var result = await _userService.ChangePassword(user, code, newPassword);

            if (result.Succeeded)
                return Content($"<html><body><h1>Your Password changed successfully!!! </h1><hr><a href= { EMAIL_VERIFIED_URI }> Please Login now! </a></body></html>", "text/html");
            else
                return BadRequest(new { message = "Reset failed!" });

}
1 Answers

I will let you know, the second function RecoveryLink has a big mistake because it is AllowAnonymous and the Id not encrypted so anyone can put any Id and change the password for anyone .. so if you want to use this philosophy (sending mail) you must encrypt and decrypt the UserId and concatenate it confirmationTokenLink.

so now, you want to make it with angular: you should make the Html page will you request like:

you should make the route RecoveryLink/AppUser/..... going to angular page by make a url is a angular route and make all functions as HTTP requsets

Related