Generate and validate both email and phone number tokens

[jenspettersson]

Hello.

We are using AspNet Core Identity and we want to send out both email confirmation token and a phone SMS message with a confirmation token as soon as a user is registered. We can do that no problems, but as soon as the user validates one of them, the other one can not be validated. I.e, the user first verifies the phone number using the token sent to his/her phone the token in the email verification doesn't work, and vice versa.

This is probably due to the fact that the SecurityStamp gets updated when validating and then the other token isn't valid anymore.

But how are you supposed to do the scenario I describe? Should it not be possible to send out multiple verification tokens in one go or do we have to first validate one thing and after that is verified, send a verification for the other?

[blowdart]

I don't think we've ever considered this, because, well, SMS is of course frowned upon these days, and TOTP and email don't clash. So yes, I'm afraid, it's verify one at a time :(