Getting Invalid Token from Browser

Question

0.00/5 (No votes)

See more:

I am generating a EmailConfirmationToken for email confirmation. The generated token looks like this:

C#

AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA48Afnm/pyU6UZrt2VXGfHAAAAAACAAAAAAADZgAAwAAAABAAAABa10013CpPZN7NSwTZYu03AAAAAASAAACgAAAAEAAAAHFDDmUWdvgFz4QCqe0ML/1gAAAAN7hpoCFiW8NcTaMNCGMLALUYL0gcfXbPjXQddI5w68mm4FfbVhMkJPbL+JTA8RXZ7mb6VgNmxS/cxdMzy5BQdIdVUIWzQYPwBlX6Oimx+zESVcCSpUSVpwI05+ls79nmFAAAAPTqCR7RSVR5zQT3UaJlcd1BokRr

I am sending that token via email as a hyperlink to the user.
When the user clicks on the link he will redirect to my confirmation function.

This is how I implemented the function:

C#

[Route("Register/ConfirmEmail")]
[HttpGet]
public async Task<IHttpActionResult> ConfirmEmail(string userId, string code)
{
    string errorMessage = null;
    if (userId == null || code == null)
    {
        errorMessage = "Die Benutzeridentifikation oder der Aktivierungscode sind beschädigt";
        return RenderEmailConfirmedPage(userId, errorMessage);
    }
    var registerContext = new RegisterContext
    {
        UserId = userId,
        ActivationCode = code
    };
    var result = await userService.ConfirmEmailAsync(registerContext);

The problem is the code which I get as string is invalid. Look at the following token:

C#

AQAAANCMnd8BFdERjHoAwE/Cl sBAAAA48Afnm/pyU6UZrt2VXGfHAAAAAACAAAAAAADZgAAwAAAABAAAABa10013CpPZN7NSwTZYu03AAAAAASAAACgAAAAEAAAAHFDDmUWdvgFz4QCqe0ML/1gAAAAN7hpoCFiW8NcTaMNCGMLALUYL0gcfXbPjXQddI5w68mm4FfbVhMkJPbL JTA8RXZ7mb6VgNmxS/cxdMzy5BQdIdVUIWzQYPwBlX6Oimx zESVcCSpUSVpwI05 ls79nmFAAAAPTqCR7RSVR5zQT3UaJlcd1BokRr

Do you know why all + are replaces with a space " " ?

Posted 6-Oct-15 0:12am

Airbag

Updated 6-Oct-15 0:14am

v2

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard Deeming · Accepted Answer · 2015-10-06T02:30:00

It looks like you've forgotten to URL-encode the code when you created the confirmation URL. For backwards-compatibility, browsers treat a + in the query-string as an encoded space.

When you generate the URL, you need to use the HttpUtility.UrlEncode method[^] to encode the parameters.

For example:

C#

string url = string.Format("yoursite/controller/action?userId={0}&code={1}",
    HttpUtility.UrlEncode(userId),
    HttpUtility.UrlEncode(code));

Or, using the code from the tutorial on the ASP.NET site[^]:

C#

var callbackUrl = Url.Action(
    "ConfirmEmail", "Account", 
    new { userId = user.Id, code = code }, 
    protocol: Request.Url.Scheme);