What is the logic is MembershipUser.ResetPassword() method

Question

Normally, ResetPassword(string passwordAnswer) returns a new password for the membership user. ChangePassword(string oldPassword,string newPassword) takes two parameters: old and new password. I'm OK with that but in the code below:

string pwd = mu.ResetPassword(k.SecretAnswer);
mu.ChangePassword(pwd, k.password);
return RedirectToAction("Login");

According to this code, pwd is contains old password, but ResetPassword() method returns a new random password. So how can pwd represent old password? Shouldn't the ResetPassword() method return a new password? What am I missing? What is the logic is behind?

Answer 1

Reset password created a password that must be reset upon first usage. It is used more as a token (in the auth realm) than an actual password.

So when you called mu.ChangePassword(pwd, k.password);, you "exchanged" the pwd token for a "normal" password.

If you had skipped changing the password in the line above and tried to log in using pwd from the Reset method it would not have succeeded. The UI would force you to change your password and then login with the new password.

This is designed so a user is the only one to have ever seen their password in plain text (ie unencrypted).

EDIT: What exactly is a token and what is the difference between a token and a password?

Short answer(s):

1. A password can be used multiple times while a token can only be used once.
2. A password is verified while a token is redeemed.
3. A password requires verification for each use. A token requires verification before it is given.

While both tokens and passwords are used to gain access, it's how they are used that differentiates them.

Let's try some real-world examples (granted these examples don't align 100% with our use case, but I believe they could help).

The PIN for your ATM card is a password because:

1. it is secret
2. it is verified each time you use it
3. you can use it over and over

If you take a suit to the dry cleaners, they hand you a ticket (with a number) that you will use to get your suit back. That's a token because:

1. You must physically possess the ticket to get your suit back
2. If you have the ticket, you get the suit. No questions asked. You proved it was your suit when you dropped it off.
3. Once you use it, the ticket is worthless.