title: ASP.NET Core Identity invalid token on confirmation email
body: <p>This is a very similar question to this
  <a href="https://stackoverflow.com/questions/27535233/aspnet-identity-invalid-token-on-confirmation-email">aspnet identity invalid token on confirmation email</a>
  but the solutions are not valid because I am using the new ASP.NET Core 1.0 that includes ASP.NET Core Identity.</p>
  
  <p>My scenario is as follows:</p>
  
  <ol>
  <li><p>In the back end (ASP.NET Core) I have a function that sends a password reset email with a link. In order to generate that link I have to generate a code using Identity. Something like this.</p>
  
  <pre><code>public async Task SendPasswordResetEmailAsync(string email)
  {
      //_userManager is an instance of UserManager&lt;User&gt;
      var userEntity = await _userManager.FindByNameAsync(email);
      var tokenGenerated = await _userManager.GeneratePasswordResetTokenAsync(userEntity);
      var link = Url.Action("MyAction", "MyController", new { email = email, code = tokenGenerated }, protocol: HttpContext.Request.Scheme);
       //this is my service that sends an email to the user containing the generated password reset link
       await _emailService.SendPasswordResetEmailAsync(userEntity , link);
  }
  </code></pre>
  
  <p>this would generate an email with a link to:</p>
  
  <p><code>http://myapp:8080/passwordreset?code=CfDJ8JBnWaVj6h1PtqlmlJaH57r9TRA5j7Ij1BVyeBUpqX+5Cq1msu9zgkuI32Iz9x/5uE1B9fKFp4tZFFy6lBTseDFTHSJxwtGu+jHX5cajptUBiVqIChiwoTODh7ei4+MOkX7rdNVBMhG4jOZWqqtZ5J30gXr/JmltbYxqOp4JLs8V05BeKDbbVO/Fsq5+jebokKkR5HEJU+mQ5MLvNURsJKRBbI3qIllj1RByXt9mufGRE3wmQf2fgKBkAL6VsNgB8w==</code></p></li>
  <li><p>Then my AngularJs application would present a view with a form to enter and confirm the new password, and would PUT a JSON object with the new password and the code that got from the query parameter in the URL.</p></li>
  <li><p>Finally my back end would get the PUT request, grab the code and validate it using Identity like this:</p>
  
  <pre><code>[HttpPut]
  [AllowAnonymous]
  [Route("api/password/{email}")]
  public async Task&lt;IActionResult&gt; SendPasswordEmailResetRequestAsync(string email, [FromBody] PasswordReset passwordReset)
  {
      //some irrelevant validatoins here
      await _myIdentityWrapperService.ResetPasswordAsync(email, passwordReset.Password, passwordReset.Code);
      return Ok();
  }
  </code></pre></li>
  </ol>
  
  <p>The problem is that Identity responds with an </p>
  
  <blockquote>
    <p>Invalid token</p>
  </blockquote>
  
  <p>error. I have found that the problem is that the codes don't match and the above code would be received back in the JSON object in the PUT request as follows:</p>
  
  <pre class="lang-none prettyprint-override"><code>CfDJ8JBnWaVj6h1PtqlmlJaH57r9TRA5j7Ij1BVyeBUpqX 5Cq1msu9zgkuI32Iz9x/5uE1B9fKFp4tZFFy6lBTseDFTHSJxwtGu jHX5cajptUBiVqIChiwoTODh7ei4 MOkX7rdNVBMhG4jOZWqqtZ5J30gXr/JmltbYxqOp4JLs8V05BeKDbbVO/Fsq5 jebokKkR5HEJU mQ5MLvNURsJKRBbI3qIllj1RByXt9mufGRE3wmQf2fgKBkAL6VsNgB8w==
  </code></pre>
  
  <p>Notice that where there was <code>+</code> symbols now there are spaces <code></code> symbols and obviously that causes Identity to think the tokens are different.
  For some reason Angular is decoding the URL query parameter in a different way that was encoded.</p>
  
  <p>How to resolve this?</p>