title: How can I retrieve a user from a password reset token in ASP.NET Core?
body: <p>I have an ASP.NET Core 2.1 web application and am adding forgot password functionality. I have looked at several examples, and they seem to take one of two approaches. The first approach is to include either the user id or the user's email in the password reset url along with the password reset token. The second approach is to include only the password reset token in the password reset url and then require the user to enter identifying information (such as email) when attempting to change the password (<a href="http://www.binaryintellect.net/articles/df920caf-ba69-4714-938f-fbb358532c0f.aspx" rel="nofollow noreferrer">Binary Intellect example</a>). Is there a way to look up the user given just the password reset token? </p>
  
  <p>My team lead has asked me to pass just the token in the password reset url and then look up the user. My initial research makes me believe that I would have to manually keep record of the user id and token relationship, but am hoping that there's something built in. I have reviewed the <a href="https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.identity.usermanager-1?view=aspnetcore-3.1" rel="nofollow noreferrer">ASP.NET Core UserManager documentation</a>, but did not find any methods for retrieving a user for a given token.</p>
  
  <p>Here's some of the example code embedding the user id in the password reset URL (<a href="https://jakeydocs.readthedocs.io/en/latest/security/authentication/accconfirm.html" rel="nofollow noreferrer">Microsoft Password Recovery Doc</a>):</p>
  
  <pre><code>var code = await _userManager.GeneratePasswordResetTokenAsync(user);
  var callbackUrl = Url.Action("ResetPassword", "Account", new { userId = user.Id, code = code }, protocol: HttpContext.Request.Scheme);
  </code></pre>