Create and Validate Invitation Code / Token

Question

Using ASP.NET Core I am creating a system to invite users to Join a Group, Get Free Credits, ...

When inviting a User to Join a Group I create an Invitation which is saved in the database:

The token is saved on the database along with other information:

Invitation invitation = new Invitation {
  InvitationType = "JoinGroup",
  Completed = false,
  Expiry = DateTime.Now.AddDays(4),
  Token = some_token,
  Parameters = new List<Parameter> { 
    new Parameter { Name = "GroupId", Value = 22 },
    new Parameter { Name = "RoleId", Value = "Admin" },
    new Parameter { Name = "Email", Value = "[email protected]" },
  }
}

Then I send an email with an url:

/invite?token=some_token

When the user accesses the url I get the record with the given token.

With that information I do whatever I need to do, for example, add User to the Group.

Question

How should I create a unique token?

Which information should I include in the token?

And how should I validate it?

Answer 1

ASP.NET Core Identity provides functionality for generating tokens for different purposes.

Using the UserManager you can generate tokens for multiple purposes.

One of the methods available is the UserManager.GenerateUserTokenAsync(TUser, String, String).

You can verify the token using the UserManager.VerifyUserTokenAsync(TUser, String, String, String) method.

Reference To Documentation

Here is link that will help you getting started: Identity Tokens