MVC 4 Password Recovery

Question

First I am quite new to MVC and I am trying to implement a password recovery functionality for MVC 4. I am implementing this using this technique posted here: Where to find C# sample code to implement password recovery in ASP .NET MVC2

I understood the way it works however there is missing a helper class that I try to implement right now. I am talking about the class: NotificationsHelper.SendPasswordRetrieval(model.Email, this.ControllerContext);

The RetrievePassword acction controller on the controller has a parameter PasswordRetrievalModel model. I guess that this is a class model that connects to db and implements some properties among theme is a string property called Email. Is this correct?

Than, the NotificationsHelper.SendPasswordRetrieval(model.Email, this.ControllerContext); static class implements this static method SendPasswordRetrievla with 2 paramateres: model.Email that is the string property frrom the PasswordRetrievalModel model class, so this will be the user email to which we will send the email. Than the second parameter is this.ControllerContext. What is the point of this parameter what values will contain that are sent to the SendPasswordRetrieval method?

Than I implemented the class like this:

public static class NotificationsHelper
{
    public static bool SendPasswordRetrieval(string emailAddress, ControllerContext ctx)
    {
        try
        {
            StringBuilder emailMessage = new StringBuilder();

            emailMessage.Append("<br />");
            emailMessage.Append("Hello,");
            emailMessage.Append("You have requested a password recovery.");
            emailMessage.Append("<br />");
            emailMessage.Append("Please click the link below to change your password: <br />");
            emailMessage.Append("<br />");
            emailMessage.Append(string.Format("http://www.example.com/Account/Validate?email={0}&token={1}", emailAddress, "**345982374532453435345**"));
            emailMessage.Append("<br />");

            MailMessage email = new MailMessage();
            email.From = new MailAddress("[email protected]");
            email.To.Add(new MailAddress(emailAddress));
            email.Subject = "domain.com Password Recovery";
            email.Body = emailMessage.ToString();
            email.IsBodyHtml = true;

            SmtpClient smtpServer = new SmtpClient();
            smtpServer.Host = "smtp.gmail.com";
            smtpServer.Port = 587;
            smtpServer.Credentials = new NetworkCredential("username", "password");
            smtpServer.EnableSsl = true;
            smtpServer.Send(email);
            return true;
        }            
        catch (Exception e)
        {
            Trace.WriteLine(String.Format("Failure to send email to {0}.", emailAddress));
            return false;
        }
    }
}

In the code above I listed the line where the url is formatted, how do I bring there the token using the code @agarcian provided? Is the token coming from the second parameter ControllerContext? If yes how do i get it from there?

Answer 1

Add new column for usertable name it pwdresetTocket, when user request to reset password insert Guid.NewGuid() in pwdresetTocket field for that user, append the same in callback URL

if you don't want to add column to existing table, you can create a new table and map it to user Table.

Then your method looks like this.

public static bool SendPasswordRetrieval(string emailAddress, ControllerContext ctx)
    {
        try
        {
            StringBuilder emailMessage = new StringBuilder();
          string token = Guid.NewGuid();
        // call to a method that will update the table with token
        updateUsertablewithResetTocket(tocken);

            emailMessage.Append("<br />");
            emailMessage.Append("Hello,");
            emailMessage.Append("You have requested a password recovery.");
            emailMessage.Append("<br />");
            emailMessage.Append("Please click the link below to change your password: <br />");
            emailMessage.Append("<br />");
            emailMessage.Append(string.Format("http://www.example.com/Account/Validate?email={0}&token={1}", emailAddress, token));
            emailMessage.Append("<br />");

            MailMessage email = new MailMessage();
            email.From = new MailAddress("[email protected]");
            email.To.Add(new MailAddress(emailAddress));
            email.Subject = "domain.com Password Recovery";
            email.Body = emailMessage.ToString();
            email.IsBodyHtml = true;

            SmtpClient smtpServer = new SmtpClient();
            smtpServer.Host = "smtp.gmail.com";
            smtpServer.Port = 587;
            smtpServer.Credentials = new NetworkCredential("username", "password");
            smtpServer.EnableSsl = true;
            smtpServer.Send(email);
            return true;
        }            
        catch (Exception e)
        {
            Trace.WriteLine(String.Format("Failure to send email to {0}.", emailAddress));
            return false;
        }
    }

once user resets the password, empty the reset token field