maxtoroq/mvcaccount

Authentication and Account Management plugin for ASP.NET MVC

mvcaccount's Issues

Minimize the properties/columns required on user account

There are many properties that users probably don't care about, e.g. FailedSignInAttempts, FailedSignInAttemptWindowStart, EmailVerificationTicketExpiration, EmailChangeTicketExpiration, PasswordResetTicketExpiration. Instead of having to implement explicit properties/columns for these we could hide them in a single property, used exclusively by MvcAccount, in url encoded or JSON format. If an explicit property already exists that is used instead.

Another benefit is that, if new functionality that requires persistence is implemented, there would be no need to do an upgrade of the code or database schema.

Point out important part in installation instructions

Point out important part in installation instructions

Tell to add:

Global.asax.cs
ViewEngines.Engines.EnableCodeRouting();

Need to be able to create users

How do I do that?

Cannot override template for input model in EditorTemplates

This has been broken since v0.9

By using namespaces it was no longer possible to ship a single Object.cshtml to be used for all models. The workaround was to use an explicit template reference, e.g. @inputHtml.EditorForModel("../../Shared/EditorTemplates/Object"), since it's always found the framework never attempts to look in EditorTemplates.

The workaround is to override the view and change to @inputHtml.EditorForModel().

Use DataType.EmailAddress

Need to wait for fix, or workaroud this issue.

Use EmailAddressAttribute on .NET 4.5

Use type="email"

Email Verification and HTML mail templates

Hi maxtoroq, I started implementing MvcAccount for use on the new LaunchBox Games Database website here: http://gamesdb.launchbox-app.com.

It's been great and is working really well so far, so thank you very much. The only missing pieces at this point are registration and HTML email messages.

Registration I've been able to implement myself, but it's been somewhat of a challenge primarily due to the use of internal classes. In order to make use of updates, I'd rather not copy the code into my project and tweak it there; I'd rather continue to use the Nuget packages, but the internal classes are making it a tad bit difficult. How would you suggest I send the email out to verify the user's email after registration?

Also per the emails, I'd like to figure out how to make them HTML-driven. I think it'd be easy if I were somehow able to override the IAccountContext.RenderEmailView method, but it's internal so I don't see an easy way to do that. Would you have a recommended solution for that?

Again thank you very much for this project and any help you can provide.

Thanks,
Jason

Exception while resetting password

Description

When trying to reset the password, an HttpException may occur if the id parameter of the reset URL contains an invalid value.

Steps to Reproduce

1. Run the sample application.
   • Configuring mailSettings in Web.config is required.
2. Click on Can't access your account? link.
3. Type [email protected] and click on Submit button.
4. Open the email message sent and copy the reset link.
5. Replace the last character of the copied link with another character to make the id parameter invalid.
6. Paste the modified link into the web browser.

Expected Result

It should return status code 404 Not Found so that a proper error page can be displayed to user.

Possible Solution

The culprit is the call to MachineKey.Decode in Parse method of VerificationData class.
That could be solved by catching HttpException and returning null, just like ArgumentException.

public static VerificationData Parse(string cipher) {
   .
   .
   .
   try {
      ticketBytes = MachineKey.Decode(cipher, MachineKeyProtection.Encryption);
   } catch (ArgumentException) {
      return null;
   } catch (HttpException) {
      return null;
   }
   .
   .
   .

Leverage MVC 5.1 htmlAttributes support for class="form-control"

Incompatibility with NotFoundMvc

Description

NotFoundMvc provides a user-friendly '404' page whenever a controller, action or route is not found in an ASP.NET MVC3 application (https://github.com/andrewdavey/NotFoundMvc).
The MvcAccount Sign In page doesn't work properly when the application is using NotFoundMvc.

Steps to Reproduce

1. Install NotFoundMvc:
   • Open Visual Studio menu Tools -> Library Package Manager -> Package Manager Console;
   • On Package Manager Console, type Install-Package NotFoundMvc.
2. Open Samples application properties:
   • Click on Web tab;
   • Uncheck Use IIS Express;
   • Click on Create Virtual Directory button.
3. Run Samples application.
4. Try to login by entering an invalid user and password.
   • A blank page is displayed with the following text: "Bad request".

Expected Result

The usual Username and password do not match message should be displayed.

Possible Solution

Add Response.TrySkipIisCustomErrors = true; to SignIn method (the second overload) of AuthController class.

public ActionResult SignIn(SignInInput input, string returnUrl) {
   .
   .
   .
   if (result.IsError) {
      Response.TrySkipIisCustomErrors = true;
      return View().WithErrors(result);
   }
   .
   .
   .

Otherwise, to make sure this kind of issue doesn't occur to other MvcAccount pages, add Response.TrySkipIisCustomErrors = true; to ExecuteResult method of OperationActionResult class in operationmodel library (https://github.com/maxtoroq/operationmodel).

public override void ExecuteResult(ControllerContext context) {

   HttpResponseBase response = context.HttpContext.Response;

   response.TrySkipIisCustomErrors = true;

   if (this.operationResult != null) {
   .
   .
   .

More about TrySkipIisCustomErrors: http://blog.janjonas.net/2011-04-13/asp_net-prevent-iis_75_overriding-custom-error-page-iis-default-error-page .