Considering PhoneNumber
as my customized user's Username
, I need only users whose phone number is verified to be able to Sign-Up. So I created a temp user and generated verification token for him/her and sent back the token to provided phone number as follows:
public Task Handle(SendSignupSmsRequest request)
{
var user = new CustomUser { UserName = request.PhoneNumber, PhoneNumber = request.PhoneNumber };
var token = await _userManager.GenerateUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, "sign-up");
// send token to provided phone number
}
In sign-up request handler, I tried to re-create the same temp user and verify the token as follows:
public Task Handle(SignupRequest request)
{
var user = new CustomUser { UserName = request.PhoneNumber, PhoneNumber = request.PhoneNumber };
var tokenVerified = await _userManager.VerifyUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, "sign-up", request.Token);
if (!tokenVerified)
// do something;
else
// do something else
}
I see that tokenVerified
is always False
! I tried the following to find what is wrong with my code:
Verify token with the same temp user ====> successful verification
var user = new CustomUser { UserName = request.PhoneNumber, PhoneNumber = request.PhoneNumber };
var token = await _userManager.GenerateUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, "sign-up");
var tokenVerified = await _userManager.VerifyUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, "sign-up", request.Token);
Verify token with the new temp user created just like temp user ====> unsuccessful verification
var user = new CustomUser { UserName = request.PhoneNumber, PhoneNumber = request.PhoneNumber };
var token = await _userManager.GenerateUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, "sign-up");
user = new CustomUser { UserName = request.PhoneNumber, PhoneNumber = request.PhoneNumber };
var tokenVerified = await _userManager.VerifyUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, "sign-up", request.Token);
It all comes down to SecurityStamp
!
First, assign a temporal security stamp to user created in send sign-up sms request handler. Then in sign-up request handler set the same security stamp for the re-created user. Doing so, the token will be verified successfully.