Password reset emails not sent for unconfirmed users

[SoftCircuits]

I've built a new website using ASP.NET Core 3.1. I set it up to use standard Identity for individual accounts. But when I tried the Reset Password command, no email was sent.

There is no warning, error or alert. And I cannot debug it without bring a lot of Identity scaffolding into my project. All that happens is I never get the email.

The issues appears to be that no email is sent when the user account's EmailConfirmed column is set to false. The email is sent when I set this column to true.

My website does not contain secure data and does not require user accounts to be confirmed. In this case, a developer could waste a lot of time trying to troubleshoot this issue.

I don't agree with this behavior. I can understand if the account is not in the database, but if the email is not genuine then the person causing trouble will not receive the email.

But as long as it behaves like this, there should be some indication to the developer that this is by design. And for that matter, what is the correct way to fix it once the issue has been uncovered? I do not need users to confirm their emails.

[blowdart]

This is by design, otherwise it could be abused by spam.

Override the registration scaffolding, and set the email to confirmed yourself.

Remember the identity UI is opinionated. If you disagree with its opinions then you override it and change it.

[SoftCircuits]

@blowdart The identity UI is more than opinionated. I doesn't include a message to say the user needs to confirm the email. It let's them log in using the new account. Everything looks just fine. Except for a maddening, silent and non-working reset password function.

I think it's a bad approach.

Maybe I can figure out which scaffolding I need to override without bringing dozens of modules into my project.

[blowdart]

Password reset should error at least, @HaoK opinions? Log an issue for 6.0?

[SoftCircuits]

@blowdart Actually, an error could be a security issue as well. It allows anyone to find out if your email is registered at a particular website, which could also be used as a stepping stone to try and figure out your password.

The easiest solution for me is an option to not require a confirmed email. Password reset should then work regardless. That seems like a reasonable request.

[Tratcher]

For some reason I frequently have people register for new accounts using my email address. I wish more sites required validated addresses before letting you log in or reset passwords.

Also, the validation email needs a negative option that deletes the account, or at least removes the email address. Most sites don't have this, so what I usually have to do is use the password reset (which does frequently work for unconfirmed accounts), and then delete the account for them.

[SoftCircuits]

I just want it to be configurable. No email sent if you don't require confirmed accounts.

Besides the code doesn't send a confirmation email out of the box. By default, no email is sent, there's no indication an email is needed, and the reset password doesn't work. This is broken.