09 Implementing Forget & Reset Password in ASP.NET Core Web API using ASP.NET Identity | AK Academy

[@NK-xw4uu]

This is a gold mine for user auth concept. Well done!

[@ahmad.mozaffar]

That comment made my day

[@amierulbasyaryusoff2459]

Your tutorial was a game-changer for me! I had been banging my head against the wall trying to figure out how to turn a scaffolded identity into a Web API, but your step-by-step instructions made it all so clear. Thank you for making such a difference in my learning journey.

[@ahmad.mozaffar]

This comment made my day, thank you so much. Happy that it was helpful for you!

[@andresbeltran5779]

Finished series Yujuuuuu, thanks for sharing

[@ahmad.mozaffar]

Hey Andres, so happy that you liked the course, I hope it was beneficial for you

[@abelghaniE]

We thank you for the quality of the explanations. Continue

[@ahmad.mozaffar]

Thank you so much for that amazing feedback!! the best is yet to come

[@sale1609]

Hello Ahmad, truly amazing! I never like a video on youtube but this course really compelled me to like all your videos. The content is perfectly created for junior and senior developers. Thumbs up. I would love to know how we can make these APIs scalable and efficient in performance. Thanks and keep up this great work.

[@ahmad.mozaffar]

Heey, Thank you so much for such a kind and encouraging comment, that really made my day, sorry for late reply and thank you so much again, regarding you question I will make sure to have a video about how to develop a full API very soon which will cover all the mentioned things Thanks again

[@cdv130]

You should add a Decode(token) and a Encode(token) helper functions in your UserService class, to cut down on the copy pasta! Other than that, I really liked this!

[@ahmad.mozaffar]

You are totally right, so happy that you liked it

[@diamondchirisa1590]

Thanks bro. Watched all the videos of the playlist. I deserve a certificate of completion. lol

[@ahmad.mozaffar]

Thanks man Haha that's nice I will think of it ;-P

[@diamondchirisa1590]

@@ahmad.mozaffar No worried bro. Do you have any tutorial on claims, roles and policies relating to this course?

[@ahmad.mozaffar]

Diamond Chirisa Unfortunately but I don’t have yet

[@DươngPhạmTùng-l4t]

It is so useful, thank bro!

[@ahmad.mozaffar]

Thanks for your nice comment

[@MihaiMoisei]

Thanks for all.

[@ahmad.mozaffar]

Mihai Moisei Glad to help

[@umidzeynalov94]

Hi! I Learning more... Thanks

[@ahmad.mozaffar]

Super super happy to hear that!!!

[@NK-xw4uu]

Can you tell me whether you could have used static page instead of razor page?

[@ahmad.mozaffar]

Here just because we are using ASP MVC App we need to embed some C# code in it and this is why we have used razor but you can use HTML with some JS to fetch the token from the URL and put in the form

[@leaguefun]

Awesome tutorial !!! By the way, I find some difficulties to deploy it to be used in IIS, would you mind to provide some suggestions? thanks.

[@ahmad.mozaffar]

That's so nice of you Thanks for your feedback Of course I'm here to help, just let me know the issue!

[@leaguefun]

@@ahmad.mozaffar I published the project as self-contained folder through VS, and put the folder inside the iis folder i.e. inetpub/wwwroot/identity, change the application pool into .NET CLR with not managed code, however, when i tried to access the api endpoint, its returned 505, am i doing something wrong ? thanks in advance :D

[@ahmad.mozaffar]

Great, could you just please push a screenshot of the error so I can have more details You can share the picture on Twitter @AhmadMozaffar99 Thanks

[@leaguefun]

@@ahmad.mozaffar You are nice, I had twitted the screenshots, thanks :D

[@ahmad.mozaffar]

Thanks, I have checked it

[@sekars6223]

Thanks for Very good contents .

[@minhnguyenquang1724]

This video is so amazing. How can I add external login like Google or Facebook? Thank you very much.

[@ahmad.mozaffar]

Thanks for nice feedback, yeah actually you can do that easier using Identity services like Azure Active Directory B2C, as it's easier to complete

[@venkateshsiddagani3774]

Hi Sir, When I was adding services.AddIdentity.... I was getting error identitybuilder doesn't contain a definition for AddEntitityFrameworkStore and no accessible extension method AddEntityFrameworkStores accepting a first argument of type IdentityBuilder. Can you pls help me here

[@ahmad.mozaffar]

Hi dear You should use AddScoped instead of AddIdentity

[@TheAhmedasdasd]

Hi, is that the last video in that series?

[@ahmad.mozaffar]

ahmed ibrahiem Yes That’s the last one If you are interested in more complex authentication scenarios I highly recommend this kzbin.info/www/bejne/al6VqISNhLmZbMU

[@souravbhattacharjee3994]

Also, how can I set an expiration policy on the password reset/ email confirmation token?

[@ahmad.mozaffar]

Surely you can very easily services.Configure(options => options.TokenLifespan = TimeSpan.FromHours(3));

[@souravbhattacharjee3994]

@@ahmad.mozaffar Thanks

[@ahmad.mozaffar]

Sourav Bhattacharjee Pleasure

[@codigodavinchi]

I know this question is out of the scope of the video but, Do you know how can I add an Alert to show the result in the password change form? I appreciate any information you give me... Thanks!

[@ahmad.mozaffar]

Hi, thanks for reaching out, could you explain a little bit more please

[@codigodavinchi]

Hi @@ahmad.mozaffar I mean, I'm trying to figure out how to show the result of the password change in a good looking way instead of the plain json string result from te API so I want to create an alert, like a window, to show that result

[@nizamarif5825]

Hi, I'm following your example in trying to implement password reset for a web api project consumed by a mobile app . However, I get error 405 when I post the form to ResetPassword endpoint. Yes I've attributed the endpoint point with HttpPost and I make sure that I have the value "post" in method tags in my Razor page. Do you have any idea why, when calling the endpoint for ResetPassword I get this error? When testing with postman it works well.

[@ahmad.mozaffar]

Hi dear Thanks for your interest 405 means you are send the wrong format from the client or Method not allowed Make sure in the controller to decorate your parameter with [FromBody] And to send a post request correctly from your mobile app

[@nizamarif5825]

@@ahmad.mozaffar thanks for your answer. The call to ResetPassword is made from a browser using a post method. And yes the parameter is decorated with [FromBody].

[@ahmad.mozaffar]

@@nizamarif5825 could you please share with me the code from the client side via my Twitter account @AhmadMozaffar99

[@nizamarif5825]

​@@ahmad.mozaffar I managed to find the error. Didn' add the slash characters to the action method value which meant I got a relative url. Thanks for your time.

[@ahmad.mozaffar]

@@nizamarif5825 Happy for that Thanks

[@MuhammadAsgir-fp1ee]

Sir I am working in MVC core 3.1 this API Code, will work for me. ???

[@ahmad.mozaffar]

Hi, yes the concepts are the same just little adjustments and version of the libraries

[@Artavazd.kirakosyan]

thanks for a good contents

[@fernandoschilipackramos5541]

Hi, how can I get the user name when he logs in? I mean on postman once a user successfully Login there are 3 fields "message", "isSuccess" ,"Errors", "expireDate". In my case, I want to return his name as well, how can I return the claims "Name" (this is a column I added on my table aspnetUsers). I'm already getting this info once he registers in the API now I just want to get his name once he logins(so I can use this info on my app to show the username), should I extend this class to exhibit his name or try a different approach? Thanks for the videos and the kindness to reply :)

[@ahmad.mozaffar]

Hi dear thanks for reaching out you can add a new property or the best way to do this I have not mentioned that in the videos but I will make a new video very soon about that which is add it to the claims of the access tokens when you set the email and other properties Then in the client you should decode the access token so you get a list of claims you put like email, name, phone ..... This link will help you in the decoding process after you receive the token from the server do this in the client developer.okta.com/blog/2019/06/26/decode-jwt-in-csharp-for-authorization

[@fernandoschilipackramos5541]

@@ahmad.mozaffar Alright thanks a lot! Looking forward to these new videos :)

[@ahmad.mozaffar]

Fernando Schilipack Ramos You are must welcome mate

[@shect1]

good video but just one note, you should always return Ok with the same message even if you don't find an account with that email. Your implementation let's a hacker know if there's an account with that email in the system.

[@ahmad.mozaffar]

Yeah correct Will be taken into condensation thanks a lot for your feedback and your interest

[@Rizzwan7]

Nice video

[@ahmad.mozaffar]

Thanks!!

[@nirajdahal5019]

Sir if i had to add login providers like facebook, google or linkedin in this same project. How do i do that? I couldn't find a good resources for this.

[@ahmad.mozaffar]

Thank you so much for reaching out Adding such a Login provider probably you should go with it manually from scratch you write the code that validate the access token against Facebook for example, so the best way to add them and make them goes in reality if you have to implement this the best way to is go with Azure Active Directory B2C it's already implemented and to know more about this you can check the videos from 07 until 12 here kzbin.info/www/bejne/novXdIacbMqLZ8k And to implement the external auth providers just check this blog docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-add-identity-providers

[@mahmoudtaha5492]

Thank you for this great work . I have applied this and it works smoothly ,but when I use role it gives me "403 forbidden" status code while this role is recorded in database .could you help me out in this issue ?

[@ahmad.mozaffar]

mahmoud taha The role is existing and it’s applied for the logged in User

[@mahmoudtaha5492]

@@ahmad.mozaffar i mean when i try to add role like "Admin" to existing user and then i use [Authorize(Roles="Admin")] on specific resource i get "403 forbidden"

[@conaxlearn8566]

This assumes that both front end and API are developed by same group of people. If they are not developed by the same group of people, then usually it would be the front end team's responsibility to send the email with the Reset Password page URL isn't it? Because the API developer would not have any idea where they need to redirect the end user to.

[@ahmad.mozaffar]

Somehow yes But at the end you can redirects the user to page different than the app I mean the reset password could happen in a separated website, and let the client-side UWP in this case just opens that webpage to reset the password

[@amer570]

many thanks

[@ahmad.mozaffar]

Thanks for your support

[@souravbhattacharjee3994]

Thanks for the videos. How can I sign off the user so that the token expires immediately?

[@ahmad.mozaffar]

Thanks for reaching out This is possible but a little bit hard Usually logout just removes the access token from the client, also the expiry date for the token should be too short for example 5 mins and make a refresh token endpoint You can find more about this here stackoverflow.com/questions/45748732/could-we-destroy-invalidate-jwt-token-in-asp-net-core

[@souravbhattacharjee3994]

@@ahmad.mozaffar I understand, thanks

[@ahmad.mozaffar]

Sourav Bhattacharjee Happy for that

[@poojamaurya5977]

where I can find a UserManager class?

[@ahmad.mozaffar]

Hi dear It's already there in the ASP.NET Identity when you install it

[@mohamadhussen9933]

gooood work thank

[@fernandoschilipackramos5541]

Hi it's me again... haha how can I consume the endpoint "ForgetPassword" into my project? been struggling with it. I know how to test in on postman but kinda couldn't implement it yet on my mobile project, could u help? How can i create the method to consume it?! I'm using xamarin forms, the others endpoints is already working, login and register, but for forgetpassword seems different on my ApiService class

[@fernandoschilipackramos5541]

public static async Task ForgetPassword(string email) { var forgetpassword = new ForgetPassword() { Email = email, }; var httpClient = new HttpClient(); var json = JsonConvert.SerializeObject(forgetpassword); var content = new StringContent(json, Encoding.UTF8, "application/json"); var resposta = await httpClient.PostAsync(AppSettings.ApiUrl + "api/conta/forgetpassword?email=", content); if (!resposta.IsSuccessStatusCode) return false; else return true; } I tried this, but i don't think that's the right thing

[@fernandoschilipackramos5541]

I created a page to receive this user email so when he input the data it will send to my API, just dunno how to do it xD

[@ahmad.mozaffar]

Welcome back again, Thank you so much for your interest Regarding your issue what is the error you get exactly ?

[@fernandoschilipackramos5541]

@@ahmad.mozaffar Hey there! I did manage to work, It wasn't working because the property wasn't referring to anything i used the Email property of LoginModel class instead of creating a specific class just to "ForgetPassword" method & also i made some minor changes staying like this: public static async Task ForgetPassword(string email) { var forgetpassword = new LoginModel() { Email = email, }; var httpClient = new HttpClient(); var json = JsonConvert.SerializeObject(forgetpassword); var content = new StringContent(json, Encoding.UTF8, "application/json"); var resposta = await httpClient.PostAsync(AppSettings.ApiUrl + $"api/conta/forgetpassword?email={email}", content); if (!resposta.IsSuccessStatusCode) return false; else return true; }

[@ahmad.mozaffar]

@@fernandoschilipackramos5541 That a very good news, good luck dear

[@sandeepbhor04]

thanks for the contents

[@ahmad.mozaffar]

Sandeep Bhor Thank you

[@yunusserter]

Thanks

[@hosnimahdhi6529]

Great, how to access to resources (data) with own token (not any valid token) 🙂

[@ahmad.mozaffar]

Thanks for your feedback, could you please explain a bit more?

[@burakdogan6856]

you can add already registererd validation to your register function var alreadyRegistered = await _userManager.FindByEmailAsync(model.Email); if (alreadyRegistered != null) { return new UserManagerResponse { Message = "This user is already registered", IsSuccess = false, }; }

[@ahmad.mozaffar]

Thanks for mentioning that

[@ناديالهوايات]

thanks

[@ahmad.mozaffar]

You are welcome