Login fails after changing password ASP.NET Core

Question

I'm using ASP.NET Core 1.0 and the identity stuff to authenticate and authorize the users. It all works fine except one single thing:

If the user resets or changes his password, he can't sign-in with the new credentials until the ASP.NET App is restarted. Means the new passwords are successfully saved in the database, but the Method _signInManager.PasswordSignInAsync() doesn't use the current data, but old one. It seems there is something like a cache in the EF Core or in the SignInManager/UserStore.

Sign-in after registration works also fine, it is just a problem after reset or change of the passwords.

Are you using the redis or some in-process memory cache or so? — Tseng
– Tseng, Commented Jul 4, 2016 at 10:09
Nope, currently there is no cache configured. Just the default settings, nothing special. — Juergen Gutsch
– Juergen Gutsch, Commented Jul 4, 2016 at 10:12

matt-ankerson · Accepted Answer · 2017-02-15 01:55:28Z

4

I too discovered a problem with my authentication middleware using a stale DbContext.

One solution was to refresh the user in the auth middleware's identity resolver with the following line of code:

await _dbContext.Entry(userToVerify).ReloadAsync();

Following this, I was able to verify the user's credentials against up-to-date data.

answered Feb 15, 2017 at 1:55

matt-ankerson

5625 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Juergen Gutsch · Accepted Answer · 2016-07-04 12:56:59Z

3

Found the cause of that problem: Auth is done in a separate MiddleWare which has a wrong initialization and uses an old EF DbContext.

Using the DbContext with DI is a huge problem in ASP.NET Core. The DbContext should be used in a pretty small scope, defined with a simple using statement. Unfortunately the ASP.NET Core identity uses a DbContext which is registered in the DI. The better solution would be to register just a DbContext factory to the DI, to create a small scoped DbContext overtime you need it.

answered Jul 4, 2016 at 12:56

Juergen Gutsch

1,7643 gold badges17 silver badges28 bronze badges

2 Comments

Nick Acosta Over a year ago

Thanks for sharing your insight, I could see this tripping someone up for hours.

AndrewBenjamin Over a year ago

The insight is good, but not so much for dummies like me. I don't know how to properly register a DbContext factory, so I end up with a using (new DbContext) everywhere instead.

Collectives™ on Stack Overflow

Login fails after changing password ASP.NET Core

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related