8

I have an ASP.NET Core 2.1 application that uses ASP.NET Core Identity for user management. If someone forgot their password I use the Identity SDK to generate a password reset token. Then I mail a link to the user to reset their password. The link looks like this:

https://mywebsite.com/account/resetpassword/{resetToken}

At the position of "{resetToken}" I place the URL encoded version of the reset token that the Identity SDK generated for me. The URL encoding is necessary because the token may contain special characters.

While testing the forgot password flow on my local machine everything worked, so after code review I published it to our testing environment in Azure. But while testing on Azure I get a 404 when I try to visit the password reset link. The generated link looks like this:

https://mywebsite.com/account/resetpassword/CfDJ8OdSMUPTC9lCpLB%2fYMsf17DY75oSHdCdv4KL9RTOxbAP2ukPYdX1oY8rh5A%2bRO4p3j8uBVhtSRedi1AoPxVCvNigrcSltViBkCrU9dKRM3YKrE%2fCqPRvZcP%2b9aGdadnnQlFM%2b%2bhcJ8LJHtkmEcEoTkCC0MMfNR3ttDM7L2%2boK1MhKuaqxKKeYH6iyAeK6sJe5g%3d%3d

After some fiddling with the URL I came to the conclusion that something goes wrong with the encoded + sign (%2b). Because if I remove it from the URL it successfully brings me to the reset password page, but obviously throwing an error because the token is invalid.

Part of the receiving action method looks like this:

[HttpGet]
[Route("[controller]/[action]/{*resetToken}")]
public IActionResult ResetPassword(string resetToken)

Am I doing something wrong or is Azure processing URL's another way than my local machine?

Roel de Wit
  • 121
  • 1
  • 4
  • 2
    I've run into similar issues in IIS and IISNode and it always came down to URL settings in the web.config. Have you seen this answer? https://stackoverflow.com/a/23028990/962986. If that's not your problem, can you post your web.config minus any sensitive info? – UpQuark Dec 05 '18 at 19:24
  • We're using ASP.NET Core 2.1, so we have an appsettings.json instead of a web.config. I fixed the problem by using an url encode extension method that replaces plus signs with a minus sign and forward slashes with a underscore. – Roel de Wit Dec 06 '18 at 08:40
  • There is a web.config file on an Azure App Service, on the root level, same as appsettings.json. Put the suggested solution of UpQuark there and it works! – 321X Oct 14 '20 at 21:32
  • For anyone looking into this now, I have the same issue- I'm attempting to pass a file path into an App Service and it's automatically decoding it. Still an issue, five years later. Not sure how to solve it. – PointlessSpike May 09 '23 at 09:27

0 Answers0