Confirmation Mail Token Lifetime

[Ian-Risch-Brickmakers]

Hello, I was trying to increase the email confirmation token lifetime from 10 minutes up to 1 day. How would I do that?
I already tried this, but it didn't work.

thanks in advance

[Piedone]

Behind the scenes, OC uses UserManager.GenerateEmailConfirmationTokenAsync() from Microsoft.AspNetCore.Identity. So, what you linked should work (especially the second answer). I haven't tried this, but you should most possibly set this from a modules Startup`. How exactly did you try it?

[Ian-Risch-Brickmakers]

@lampersky, I have tried this in Program.cs and in my Module startup, but it still has a lifetime of 10 minutes. I have also tried to set the lifetime of DataProtectionTokenProviderOptions, but that still doesn't change anything. How exactly and where do I have to implement this?

[lampersky]

@Ian-Risch-Brickmakers make sure your module is registered after "OrchardCore.Users" module. If it is registered before users module, then your reconfiguration will not take any results.

[Ian-Risch-Brickmakers]

@lampersky Thank you now it works

[lampersky]

@MikeAlhayek maybe it would be good to restore .AddDefaultTokenProviders() in OrchardCore.Users module?

[MikeAlhayek]

@lampersky why should we add it by default? Which provider should be the default in this case?

[Ian-Risch-Brickmakers]

The Answer was:

@Ian-Risch-Brickmakers Orchard by default is using EmailTokenProvider to generate those tokens which inherits from TotpSecurityStampBasedTokenProvider, those tokens contain only digits and their lifespan is less than 5 minutes. You can read more here. You won't be able to change this lifetime.

I had the same issue in the past and solved it by restoring DefaultProvider. Default provider was removed in this PR. (AddDefaultTokenProviders)

To restore it back you can use this code:

var dataProtectionProviderType = typeof(DataProtectorTokenProvider<>).MakeGenericType(typeof(IUser));
services.AddTransient(dataProtectionProviderType);
services.Configure<IdentityOptions>(options =>
{
    options.Tokens.EmailConfirmationTokenProvider = TokenOptions.DefaultProvider;
    options.Tokens.ProviderMap.TryAdd(TokenOptions.DefaultProvider, new TokenProviderDescriptor(dataProtectionProviderType));
});

And

@Ian-Risch-Brickmakers make sure your module is registered after "OrchardCore.Users" module. If it is registered before users module, then your reconfiguration will not take any results.

[MikeAlhayek]

@Ian-Risch-Brickmakers DataProtectionTokenProviderOptions by default is set to 1 day. You mentioned you are getting 10 mins. I am wondering if you are changing the default from 1 day to 10 mins in your code.

If configuring DataProtectionTokenProviderOptions worked as @lampersky mentioned, I am thinking you have special settings that configure the value. Additionally, if you want to configure the value without having to depend on the Users module, you can use PostConfigure<> to ensure it is configured later without having to worry about dependency.

[lampersky]

@MikeAlhayek as mentioned before, we are using EmailTokenProvider and this provider inherits from TotpSecurityStampBasedTokenProvider and this is internally using Rfc6238AuthenticationService.

This service generates six-digit codes, and by design, those codes have a very short validity period.
You can check this in dotnet repo here.

DataProtectionTokenProviderOptions by default is set to 1 day but only when you will use DataProtectorTokenProvider.

If you want to have configurable TokenLifespan you should use other than TotpSecurityStampBasedTokenProvider based providers. And this is exactly what I did in the provided code snippet here.

I've just taken authentication service from Totp Token Provider and sligthy adjusted it so I can manipulate with DateTime.UtcNow and here are the results:

As you can see after 10 minutes code generated via EmailTokenProvider is not valid anymore.

That is also why I've asked that maybe we should restore default token provider (DataProtectorTokenProvider), so we can again configure TokenLifespan.

[MikeAlhayek]

@lampersky the problem with inheriting from DataProtectorTokenProvider<> directly, is that it requires an instance of IOptions<DataProtectionTokenProviderOptions> the DataProtectionTokenProviderOptions can provide any name not just email for the protector. So you can't really create DataProtectionTokenProviderOptions instance for email only without impacting others services. Meaning if someone changes the name property in DataProtectionTokenProviderOptions all services will be impacted. I am not sure why Microsoft inherits from TotpSecurityStampBasedTokenProvider and provides no way to change the lifespan on an email token. But I don't think we should try to solve it in OC by inheriting from DataProtectorTokenProvider<>