This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 86%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAR%3C/text%3E%3C/svg%3E)
Hi, I'm currently working on a .NET core web API project and writing ResetPassword. The user wrote the email and front-end sent it to my ForgotPassword Endpoint, I checked the database and send the url with email and token in it to the user's email. This url is my ResetPassword(HttpGet) action's url and when user clicks on it it is going to my method . The ResetPassword(HttpGet) returns mail and token. I aslo have ResetPassword(HttpPost) action which requires NewPassword from UI and email and token from my ResetPassword(HttpGet) action. If everythink right the pasword will change. I think, The API part is right and as a back-end developer I dod everythink correct(according to the many tutorials and articles in the internet) but I can't understand the period between ResetPassword(HttpGet) and ResetPassword(HttpPost) actions. I mean, after clicking the link which were sent to the user's email, doesn't user have to go to the page where he will write his new password? And if User can go there and write new password , how front-end developer will get token and email from my ResetPassword(HttpGet) for sending me after user will click to the submit. Can anybody explain me, please? Because I'm working on it, almost 8 hours and haven't get any conclusion yet.
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
A set of technologies in .NET for building web applications and web services. Miscellaneous topics that do not fit into specific categories.
A component of ASP.NET Core for creating RESTful web services that support HTTP-based communication between clients and servers.
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
3 deleted commentsComments have been turned off. Learn more
Ok, but after clicking to the link, it will go to my api's httpget method.
No, the link should go to the Web application not Web API. If the browser is redirected to a Web API HTTP GET action, then the user we see a JSON response in browser not HTML.
Yes, I agree with you, but if the link will send user to the browser, then how front-end developer will get token and email? The link, which I sent to the user contains it, but it is my api's link. If I will sent the link of WEB app(probably will write it manually to the body of message) the front-end developer will not get the email and token.
Yes, I agree with you, but if the link will send user to the browser, then how front-end developer will get token and email?
If I understand correctly, the front-end developers needs to design a page that handles the email link. You'll need to explain why the front-end developers needs the token and email.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Now after clicking this link it triggers my httpget api but is has to go to the web app and somehow give email and token to the front-end developer. That is the part which confuses me.
I'm very confused... If what you said above is correct, then the front-end developer has the email and token. This data is in the link and the link is in the front-end.
We have no idea what kind of front-end application is being built. If it is an SPA then the front-end developer should be using AJAX to call your API not a link. A link causes the browser to go to the Web API site which makes no sense.
If this is a server side front-end like MVC then the link should point to an action in the web application. The web application calls the Web API application using HttpClient.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 61%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
the email link should include the token value (typically base64url encrypted value). this is passed to the reset get. the get should render the token to a hidden field that will be included on the reset post. the post verifies the token value and if password meets complexity updates.
typically the token contains the userid (so you know which user to update) and an expiration time, so the email link is valid for short amount of time.
Ok, but after clicking to the link, it will go to my api's httpget method. But user have to enter new password somewhere. This is the part that I can't understand. User clicked the link and went to the api. That is not right. User had to go to the Page where he/she will enter new password. And after clicking submit the front-end developer had to send newpassword to my httppost method where I'll change the password. But in this request it have to contain token and email from my http get method. Or there is a moment that I'm understanding wrong?
That’s correct the reset get should return an an html page. The post will be a form post.
Note: if this api is for an application, then the application would display a form asking for the email token (in this case it would be a key or QR code , rather than a link). The application when then call the webapi with the key and new password.