Reset a forgotten password

Recover access when the user forgot the password. Routes sit on the management group (facade default /identity). Mail is sent only for a confirmed account. The forgot endpoint always returns 200.

Steps

1. Collect the account email on a Forgot password screen.
2. POST /identity/forgotPassword with body { "email" }.
3. On 200, show Check your email (same copy for known and unknown addresses).
4. The reset mail carries a Base64Url-encoded reset code. IEmailSender<TUser>.SendPasswordResetCodeAsync receives an HTML-encoded Base64Url string (hosts that put the code in an HTML mail should decode entities before the user copies it, or use a link query the host owns). The client submits the Base64Url value as resetCode.
5. Collect email, reset code, and new password on a Reset password screen (or deep link that fills email and code).
6. POST /identity/resetPassword with body { "email", "resetCode", "newPassword" }.
7. On 200, sign in with the new password: POST /identity/login (LoginCookie). Persistent cookie: ?useSessionCookies=false. See Cookie auth.
8. On invalid or unknown token or user, expect 400 validation problem (for example InvalidToken). Do not reveal whether the email exists from the forgot step.

Forgot and reset do not require antiforgery or a session.

Related

• Identity management
• Cookie auth
• Register a confirmed account