Invalid token in reset password of Asp.Net web api

Question

I'm working on a project using Asp.NET web api, and my authentication system is based on identity 2.0. When user sends the ResetPassword form, he gets "Invalid token" this is my forgotpassword method

public async Task<HttpResponseMessage> ForgotPassword(ForgotPasswordViewModel model)
    {
        if (!ModelState.IsValid)
        {
            HttpError error = new HttpError(ModelState, false);
            error.Message = Resource.No_Item_Found_Message;
            return Request.CreateErrorResponse(HttpStatusCode.BadRequest, error);
        }
        var user = await UserManager.FindByEmailAsync(model.Email);
        if (user == null || !(await UserManager.IsEmailConfirmedAsync(user.Id)))
        {
            // Don't reveal that the user does not exist or is not confirmed
            HttpError error = new HttpError();
            error.Message = Resource.Process_Failed;
            return Request.CreateErrorResponse(HttpStatusCode.BadRequest, error);
        }
        var provider = new DpapiDataProtectionProvider("ECommerceWebApp");
        UserManager.UserTokenProvider = new DataProtectorTokenProvider<ECommerceUser, string>(provider.Create("UserToken"));
        var code = await UserManager.GeneratePasswordResetTokenAsync(user.Id);
        code = HttpUtility.UrlEncode(code);
        try
        {
            // var callbackUrl = new Uri(Url.Link("ResetPasswordRoute", new { userId = user.Id, code = code, newPassword = model.Password }));
            var callbackUrl = Url.Link("Default", new { Controller = "Account", action = "ResetPassword", userId = user.Id, code = code });
            await UserManager.SendEmailAsync(user.Id, "تغییر رمز عبور در IRI1", "<div style='font-family:tahoma;direction:rtl;text-align:right;font-size:12px;'>" + "<h3>اولین و بزرگترین مرکز دادوستد بدون واسطه در ایران و کشورهای همسایه</h3>لطفاً با کلیک بر روی گزینۀ تغییر رمز به صفحۀ مربوطه بروید : <br/><br/><a href=\"" + callbackUrl + "\">تغییر رمز عبور </a><br/><br/><br/><a href='iri1.com'>Iri1 Web Sites</a>" + "</div>");
        }
        catch (Exception ex)
        {
            HttpError error = new HttpError();
            error.Message = ex.Message;
            return Request.CreateErrorResponse(HttpStatusCode.BadRequest, error);

        }


        return Request.CreateResponse(Resource.Reset_Password_Message_Client);
    }

and this is my ResetPassword method

[HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public async Task<ActionResult> ResetPassword(ResetPasswordViewModel model)
    {
        if (!ModelState.IsValid)
        {
            return View(model);
        }
        var user = await UserManager.FindByEmailAsync(model.Email);
        if (user == null)
        {
            // Don't reveal that the user does not exist
            return RedirectToAction("ResetPasswordConfirmation", "Account");
        }
        var code = HttpUtility.UrlDecode(model.Code);
        var result = await UserManager.ResetPasswordAsync(user.Id, code, model.Password);
        if (result.Succeeded)
        {
            return RedirectToAction("ResetPasswordConfirmation", "Account");
        }
        AddErrors(result);
        return View();
    }

I still get invalid token error

Answer 1

I've just begun learning Identity Authentication and have no way to run samples from the Internet(I've got no visual studio). But I've noticed this method from GidHub samples, which seems to me to be wrong:

[HttpGet]
        [AllowAnonymous]
        public IActionResult ResetPassword(string code = null)
        {
            return code == null ? View("Error") : View();
        }

In my humble opinion this method should do this:

return code == null ? View("Error") : View(new ResetPasswordViewModel{Code = code});

And thus the hidden field in ResetPassword view contains the Code. When the user clicks the submit button this code will be posted with the email and password to the httppost ResetPassword action where you can access the code thus: model.Code

Now I hope you've got a valid token