ASP.NET Core Identity invalid token on confirmation email
<p>This is a very similar question to this
<a href="https://stackoverflow.com/questions/27535233/aspnet-identity-invalid-token-on-confirmation-email">aspnet identity invalid token on confirmation email</a>
but the solutions are not valid because I am using the new ASP.NET Core 1.0 that includes ASP.NET Core Identity.</p>

<p>My scenario is as follows:</p>

<ol>
<li><p>In the back end (ASP.NET Core) I have a function that sends a password reset email with a link. In order to generate that link I have to generate a code using Identity. Something like this.</p>

<pre><code>public async Task SendPasswordResetEmailAsync(string email)
{
    //_userManager is an instance of UserManager&lt;User&gt;
    var userEntity = await _userManager.FindByNameAsync(email);
    var tokenGenerated = await _userManager.GeneratePasswordResetTokenAsync(userEntity);
    var link = Url.Action("MyAction", "MyController", new { email = email, code = tokenGenerated }, protocol: HttpContext.Request.Scheme);
     //this is my service that sends an email to the user containing the generated password reset link
     await _emailService.SendPasswordResetEmailAsync(userEntity , link);
}
</code></pre>

<p>this would generate an email with a link to:</p>

<p><code>http://myapp:8080/passwordreset?code=CfDJ8JBnWaVj6h1PtqlmlJaH57r9TRA5j7Ij1BVyeBUpqX+5Cq1msu9zgkuI32Iz9x/5uE1B9fKFp4tZFFy6lBTseDFTHSJxwtGu+jHX5cajptUBiVqIChiwoTODh7ei4+MOkX7rdNVBMhG4jOZWqqtZ5J30gXr/JmltbYxqOp4JLs8V05BeKDbbVO/Fsq5+jebokKkR5HEJU+mQ5MLvNURsJKRBbI3qIllj1RByXt9mufGRE3wmQf2fgKBkAL6VsNgB8w==</code></p></li>
<li><p>Then my AngularJs application would present a view with a form to enter and confirm the new password, and would PUT a JSON object with the new password and the code that got from the query parameter in the URL.</p></li>
<li><p>Finally my back end would get the PUT request, grab the code and validate it using Identity like this:</p>

<pre><code>[HttpPut]
[AllowAnonymous]
[Route("api/password/{email}")]
public async Task&lt;IActionResult&gt; SendPasswordEmailResetRequestAsync(string email, [FromBody] PasswordReset passwordReset)
{
    //some irrelevant validatoins here
    await _myIdentityWrapperService.ResetPasswordAsync(email, passwordReset.Password, passwordReset.Code);
    return Ok();
}
</code></pre></li>
</ol>

<p>The problem is that Identity responds with an </p>

<blockquote>
  <p>Invalid token</p>
</blockquote>

<p>error. I have found that the problem is that the codes don't match and the above code would be received back in the JSON object in the PUT request as follows:</p>

<pre class="lang-none prettyprint-override"><code>CfDJ8JBnWaVj6h1PtqlmlJaH57r9TRA5j7Ij1BVyeBUpqX 5Cq1msu9zgkuI32Iz9x/5uE1B9fKFp4tZFFy6lBTseDFTHSJxwtGu jHX5cajptUBiVqIChiwoTODh7ei4 MOkX7rdNVBMhG4jOZWqqtZ5J30gXr/JmltbYxqOp4JLs8V05BeKDbbVO/Fsq5 jebokKkR5HEJU mQ5MLvNURsJKRBbI3qIllj1RByXt9mufGRE3wmQf2fgKBkAL6VsNgB8w==
</code></pre>

<p>Notice that where there was <code>+</code> symbols now there are spaces <code></code> symbols and obviously that causes Identity to think the tokens are different.
For some reason Angular is decoding the URL query parameter in a different way that was encoded.</p>

<p>How to resolve this?</p>