The virtual UpdatePasswordHash is only invoked by ResetPasswordAsync
#60.252 aberto em 7 de fev. de 2025
Métricas do repositório
- Stars
- (37.933 stars)
- Métricas de merge de PR
- (Mesclagem média 16d 9h) (258 fundiu PRs em 30d)
Description
Is there an existing issue for this?
- I have searched the existing issues
Describe the bug
We have made an override of UpdatePasswordHash, but it turns out it is only invoked by ResetPasswordAsync. For all other operations (CreateAsync, AddPasswordAsync, CheckPasswordAsync, RemovePasswordAsync) the private implementation with a password store is invoked. From an API perspective this is a very strange behavior since we had expected all updates of password hashes to use our override.
Our end goal was actually to extend the ValidatePasswordAsync method but it isn't virtual.
Expected Behavior
The protected virtual UpdatePasswordHash should be called so the customized logic is used for all operations and not only one. All operations should behave in the same way.
Steps To Reproduce
Make a custom UserManager class that derives from the built-in. Override the UpdatePasswordHash method and add some custom logic. This logic will only be invoked when resetting passwords and never in any other situation.
Exceptions (if any)
No response
.NET Version
.NET 6, 7, 8 and 9
Anything else?
Somewhat related to https://github.com/dotnet/aspnetcore/issues/12344