Question

I am having issues retaining the passwordToken between my GET Controller and my View. I see that the token is passed and added to the model correctly within the GET Controller but as soon as the HTML.BeginForm starts in the View the model has a new instance and the previous model with the passwordToken is lost. I need the passwordToken to be retained in order to use WebSecurity.ResetPassword. Any suggestions on how this could be done?

My GET Controller:

    [AllowAnonymous]
    public ActionResult PasswordReset(string passwordToken)
    {
        // Token Validation
        var usrID = WebSecurity.GetUserIdFromPasswordResetToken(passwordToken);
        var usr = _dbManager.GetUserInformation(usrID);

        if (usr == null)
        {
            //The link you are using is not valid anymore
            return RedirectToAction("Error", "Account");
        }
        else
        {
            var model = new PasswordReset();
            model.PasswordResetToken = passwordToken;
            return View(model);
        }
    }

My View:

@model Project.Models.PasswordReset
@{
ViewBag.Title = "Password Reset";
}

<h2>Password Reset</h2>

<div class="form passwordreset-form">


@using (Html.BeginForm())
{
    @Html.AntiForgeryToken()
    @Html.ValidationSummary()

    <div class="input-form">

        <div class="inputbox-label">
            @Html.LabelFor(m => m.Password)
        </div>
        <div class="inputbox">
            @Html.PasswordFor(m => m.Password)
        </div>

        <div class="inputbox-label">
            @Html.LabelFor(m => m.ConfirmPassword)
        </div>
        <div class="inputbox">
            @Html.PasswordFor(m => m.ConfirmPassword)
        </div>

    </div>
    <div style="float:right;">
        <input type="submit" value="Change Password" />
    </div>

}

</div>

My POST Controller:

    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public ActionResult PasswordReset(PasswordReset model)
    {
        //Attemp to change password
        var passwordChangeConfirmation = WebSecurity.ResetPassword(model.PasswordResetToken, model.Password); 

            //Password has been changed
        if(passwordChangeConfirmation == true)
        {
            return RedirectToAction("Index", "Home");
        }
            //Password change has failed
        else
        {
            return RedirectToAction("Error", "Account");
        }
    }

Answer 1

I ended up adjusting the POST class to make it work.

    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public ActionResult PasswordReset(PasswordReset model, string passwordToken)
    {
        //Attemp to change password
        model.PasswordResetToken = passwordToken;
        var passwordChangeConfirmation = WebSecurity.ResetPassword(model.PasswordResetToken, model.Password);

        //Password has been changed
        if (passwordChangeConfirmation == true)
        {
            return RedirectToAction("Index", "Home");
        }
        //Password change has failed
        else
        {
            return RedirectToAction("Error", "Account");
        }
    }