title: Where does AspnetIdentity stores UserTokens?
body: <p>I have ASP.Net MVC5 application. While creating application when you select Individual Authentication visual studio use scaffolding and adds code for Login, Create User, Forgot Password etc. I am using this default implementation of ForgotPassword functionality. This is how the forgot password works. </p>
  
  <p>1>     User click on forgot password link. </p>
  
  <p>2>     User enters his email address. </p>
  
  <p>3>     Application creates new Token and sends email with return URL with Token in the query string.  </p>
  
  <p>4>     User clicks on the link in email and gets redirected to ResetPassword page. </p>
  
  <p>5>     User enters new password and hit submit.  </p>
  
  <p>6>     Application Validates the user and token and resets the password.  </p>
  
  <p>Question. </p>
  
  <p>1>     After receiving email User may not click the link immediately, he may click after sometime or even after few days. In between where does ASP.NET application stores the token? I don’t see it in the database.  </p>
  
  <p>2>     Is there any expiration on the token. </p>
  
  <p>3>     On forgot password screen user enters his email and click submit to receive email with token. Let’s say he does this 3 times. So he receives 3 emails with 3 different tokens. Then he clicks on the link from any one email and resets the password.  What happens to unused tokens in other 2 emails, are they still valid? Can user click on link in other email and be able to reset password?  </p>