title: ASP.NET Membership change password not working
body: <p>I have this code for changing a user's password when they click the password reset button (with extra code to log to ELMAH so I can try to figure out what is going wrong).</p>
  
  <p>This is in ASP.NET MVC 2, using the standard aspnet membership provider, with a simple View like this:</p>
  
  <pre><code>New Password:     ______
  Confirm Password: ______
  [Reset] [Cancel]
  </code></pre>
  
  <p>The route to this view is <code>/Account/Reset/guid</code>, where guid is the user's id in the aspnet membership database.</p>
  
  <p>The key portion of the code is where it calls <code>user.ChangePassword()</code>.  You can see that it logs a message when successful.  The problem is that for some users, the success message is logged, but they can not log in with the new password.  For other users it logs the success message and they can log in.</p>
  
  <pre><code>if (user.ChangePassword(pwd, confirmPassword))
  {
      ErrorSignal.FromCurrentContext().Raise(
          new Exception("ResetPassword - changed successfully!"));
      return Json(new { 
          Msg = "You have reset your password successfully." }, 
          JsonRequestBehavior.AllowGet);
   }
  </code></pre>
  
  <p>The full code listing is:</p>
  
  <pre><code>[HttpPost]
  public JsonResult ResetPassword(string id, string newPassword, string confirmPassword)
  {
      ErrorSignal.FromCurrentContext().Raise(new Exception("ResetPassword started for " + id));
  
      ViewData["PasswordLength"] = Membership.MinRequiredPasswordLength;
  
      if (string.IsNullOrWhiteSpace(newPassword))
      {
          ErrorSignal.FromCurrentContext().Raise(
              new Exception("ResetPassword - new password was blank."));
          ModelState.AddModelError("_FORM", "Please enter a new password.");
          return Json(new { Errors = ModelState.Errors() }, JsonRequestBehavior.AllowGet);
      }
  
      if (newPassword.Length &lt; Membership.MinRequiredPasswordLength)
      {
          ErrorSignal.FromCurrentContext().Raise(
              new Exception("ResetPassword - new password was less than minimum length."));
          ModelState.AddModelError("_FORM", 
              string.Format("The password must be at least {0} characters long.", 
              Membership.MinRequiredPasswordLength));
          return Json(new { Errors = ModelState.Errors() }, JsonRequestBehavior.AllowGet);
      }
  
      if (string.IsNullOrWhiteSpace(confirmPassword))
      {
          ErrorSignal.FromCurrentContext().Raise(
              new Exception("ResetPassword - confirm password was blank."));
          ModelState.AddModelError("_FORM", 
              "Please enter the same new password in the confirm password textbox.");
          return Json(new { Errors = ModelState.Errors() }, JsonRequestBehavior.AllowGet);
      }
  
      if (confirmPassword.Length &lt; Membership.MinRequiredPasswordLength)
      {
          ErrorSignal.FromCurrentContext().Raise(
              new Exception("ResetPassword - confirm password was less than minimum length."));
          ModelState.AddModelError("_FORM", 
              string.Format("The password must be at least {0} characters long.", 
              Membership.MinRequiredPasswordLength));
          return Json(new { Errors = ModelState.Errors() }, JsonRequestBehavior.AllowGet);
      }
  
      if (confirmPassword != newPassword)
      {
          ErrorSignal.FromCurrentContext().Raise(
              new Exception("ResetPassword - new password did not match the confirm password."));
          ModelState.AddModelError("_FORM", "Please enter the same password again.");
          return Json(new { Errors = ModelState.Errors() }, JsonRequestBehavior.AllowGet);
      }
  
      bool isMatch = ValidationHelper.IsGUID(id);
      if (string.IsNullOrWhiteSpace(id) || !isMatch)
      {
          ErrorSignal.FromCurrentContext().Raise(
              new Exception("ResetPassword - id was not a guid."));
          ModelState.AddModelError("_FORM", "An invalid ID value was passed in through the URL");
      }
      else
      {
          //ID exists and is kosher, see if this user is already approved
          //Get the ID sent in the querystring
          Guid userId = new Guid(id);
  
          try
          {
              //Get information about the user
              MembershipUser user = Membership.GetUser(userId);
              if (user == null)
              {
                  //could not find the user
                  ErrorSignal.FromCurrentContext().Raise(
                      new Exception("ResetPassword - could not find user by id " + id));
                  ModelState.AddModelError("_FORM", 
                      "The user account can not be found in the system.");
              }
              else
              {
                  ErrorSignal.FromCurrentContext().Raise(
                      new Exception("ResetPassword - user is " + user.UserName));
                  string pwd = user.ResetPassword();
  
                  if (user.ChangePassword(pwd, confirmPassword))
                  {
                      ErrorSignal.FromCurrentContext().Raise(
                          new Exception("ResetPassword - changed successfully!"));
                      return Json(new { 
                          Msg = "You have reset your password successfully." }, 
                          JsonRequestBehavior.AllowGet);
                  }
                  ErrorSignal.FromCurrentContext().Raise(
                      new Exception("ResetPassword 
                      - failed to change the password, for an unknown reason"));
              }
          }
          catch (Exception ex)
          {
              ErrorSignal.FromCurrentContext().Raise(
                  new Exception("ResetPassword: " + ex));
              return Json(new { Error = ex.Message + " -&gt; " 
                  + ex.InnerException.Message }, JsonRequestBehavior.AllowGet);
          }
      }
  
      return Json(new { Errors = ModelState.Errors() }, JsonRequestBehavior.AllowGet);
  }
  </code></pre>
  
  <p>Edit: Adding a bounty to try to get this solved.  This is one of the most annoying problems on my issue list, and I have no idea how to proceed.</p>