title: ASP.NET Identity 2.1 - Password Reset Invalid Tokens
body: <p>ASP.NET Identity is returning an 'Invalid token.' response when resetting a password for users.</p>
  
  <p>I've tried the following:</p>
  
  <ul>
  <li>URL Encode the code before sending email</li>
  <li>URL Encode &amp; Decode the code before and after</li>
  <li>Copying the code to make sure it matches what was sent</li>
  <li>Ensured my user email is confirmed (I heard that could be a problem)</li>
  <li>Created a custom UserManager/Store etc.</li>
  </ul>
  
  <p>This is my email code:</p>
  
  <pre><code>var user = await UserManager.FindByNameAsync(model.Email);
  
  var code = await UserManager.GeneratePasswordResetTokenAsync(user.Id);
  var callbackUrl = Url.Action("ResetPassword", "Account", new { code }, "http");
  
  var body = string.Format("Click here to reset your password: {0}", callbackUrl);
  await UserManager.SendEmailAsync(user.Id, "Reset Password", body);
  
  return View("~/Views/Account/Login.cshtml", model);
  </code></pre>
  
  <p>The generated URL:</p>
  
  <p><code>http://localhost/Account/ResetPassword?code=XTMg3fBDDR77LRptnRpg7r7oDxz%2FcvGscq5Pm3HMe8RJgX0KVx6YbOeqflvVUINipVcXcDDq1phuj0GCmieCuawdgfQzhoG0FUH4BoLi1TxY2kMljGp1deN60krGYaJMV6rbkrDivKa43UEarBHawQ%3D%3D</code></p>
  
  <p>Finally my reset code:</p>
  
  <pre><code>if (!ModelState.IsValid)
  {
      return View(model);
  }
  var user = await UserManager.FindByNameAsync(model.Email);
  if (user == null)
  {
      // Don't reveal that the user does not exist
      return RedirectToAction("ResetPasswordConfirmation", "Account");
  }
  var result = await UserManager.ResetPasswordAsync(user.Id, model.Code, model.Password);
  if (result.Succeeded)
  {
      return RedirectToAction("ResetPasswordConfirmation", "Account");
  }
  
  ModelState.AddModelError("","Invalid Password Please Try Again");
  return View();
  </code></pre>
  
  <p>Inside the result is 1 error, <code>Invalid token.</code></p>
  
  <p>My create UserManager method:</p>
  
  <pre><code>public static CustomerUserManager Create(IdentityFactoryOptions&lt;CustomerUserManager&gt; options, IOwinContext context)
  {
      var manager = new CustomerUserManager(new CustomerUserStore(context.Get&lt;CustomerDbContext&gt;()));
  
      // Configure validation logic for usernames
      manager.UserValidator = new UserValidator&lt;Customer&gt;(manager)
      {
          AllowOnlyAlphanumericUserNames = false,
          RequireUniqueEmail = true
      };
  
      // Configure validation logic for passwords
      manager.PasswordValidator = new PasswordValidator
      {
          RequiredLength = 6,
          RequireNonLetterOrDigit = true,
          RequireDigit = true,
          RequireLowercase = true,
          RequireUppercase = true,
      };
  
      manager.EmailService = new EmailService();
  
      var dataProtectionProvider = options.DataProtectionProvider;
      if (dataProtectionProvider != null)
      {
          manager.UserTokenProvider = new DataProtectorTokenProvider&lt;Customer, string&gt;(dataProtectionProvider.Create("ASP.NET Identity"));
      }
  
      return manager;
  }
  </code></pre>
  
  <p>My Startup.Auth config:</p>
  
  <pre><code>app.CreatePerOwinContext(CustomerDbContext.Create);
  app.CreatePerOwinContext&lt;CustomerUserManager&gt;(CustomerUserManager.Create);
  
  app.UseCookieAuthentication(new CookieAuthenticationOptions
  {
      AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
      LoginPath = new PathString("/Account/Login"),
  
      Provider = new CookieAuthenticationProvider
      {
          OnValidateIdentity =
              SecurityStampValidator.OnValidateIdentity&lt;CustomerUserManager, Customer, string&gt;
              (
                  validateInterval: TimeSpan.FromMinutes(30),
                  regenerateIdentityCallback: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager),
                  getUserIdCallback: (id) =&gt; (id.GetUserId())
              )
      }
  });
  </code></pre>
  
  <p>List of tried solutions:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/25896497/asp-net-identity-2-usermanager-confirmemail-fails-in-production">ASP.NET Identity 2 - UserManager.ConfirmEmail Fails In Production</a></li>
  <li><a href="https://stackoverflow.com/questions/27535233/aspnet-identity-invalid-token-on-confirmation-email">aspnet identity invalid token on confirmation email</a></li>
  <li><a href="http://www.asp.net/mvc/overview/security/create-an-aspnet-mvc-5-web-app-with-email-confirmation-and-password-reset#reset" rel="nofollow noreferrer">http://www.asp.net/mvc/overview/security/create-an-aspnet-mvc-5-web-app-with-email-confirmation-and-password-reset#reset</a></li>
  <li><a href="https://stackoverflow.com/questions/25405307/asp-net-identity-2-invalid-token-error">Asp.NET - Identity 2 - Invalid Token Error</a></li>
  <li><a href="https://stackoverflow.com/questions/27535233/aspnet-identity-invalid-token-on-confirmation-email">aspnet identity invalid token on confirmation email</a></li>
  <li><a href="https://aspnetidentity.codeplex.com/discussions/544368" rel="nofollow noreferrer">https://aspnetidentity.codeplex.com/discussions/544368</a></li>
  </ul>
  
  <p>Thanks for any help with this problem.</p>