title: ASP.NET Identity Phone Number Token lifespan and SMS limit
body: <p>I'm building 2 factor registration API using ASP.NET Identity 2.0.<br>
  I'd like to give users ability to confirm their phone numer on demand, so even if they didn't confirm they're phone number when registering they always can request new token (making request to my API) that will be send via SMS and enter it on page (also making request to my API).<br>
  In method that is responsible for sending token I'm generating token and sending it as shown below:</p>
  
  <pre><code>var token = await UserManager.GeneratePhoneConfirmationTokenAsync(user.Id);
  var message = new SmsMessage
  {
      Id = token,
      Recipient = user.PhoneNumber,
      Body = string.Format("Your token: {0}", token)
  };
  await UserManager.SmsService.SendAsync(message);
  </code></pre>
  
  <p>and inside UserManager:</p>
  
  <pre><code>public virtual async Task&lt;string&gt; GeneratePhoneConfirmationTokenAsync(TKey userId)
  {
      var number = await GetPhoneNumberAsync(userId);
      return await GenerateChangePhoneNumberTokenAsync(userId, number);
  }
  </code></pre>
  
  <p>Each time I call my method I get SMS message that contains token, problem is user can call that metod unlimited number of times and easily can generate costs - each SMS = cost.</p>
  
  <p>I'd like to limit number of requests user can do to that method to one every X minutes.</p>
  
  <p>Also I noticed that when I do multiple requests I get same token, I've tested my method and it looks that this token is valid for 3 minutes, so if I do request in that  minutes time window I'll get same token.</p>
  
  <p>Ideally I'd like to have single parameter that would allow me to specify time interval between requests and phone confirmation token lifespan.</p>
  
  <p>I've tried setting token lifespan inside UserManager class using:</p>
  
  <pre><code>appUserManager.UserTokenProvider = new DataProtectorTokenProvider&lt;User,int&gt;(dataProtectionProvider.Create("ASP.NET Identity"))
  {
      TokenLifespan = new TimeSpan(0,2,0)//2 minutes 
  };
  </code></pre>
  
  <p>but this only affects tokens in email confirmation links.</p>
  
  <p>Do I need to add extra field to my user table that will hold token validity date and check it every time I want to generate and send new token or is there easier way?</p>
  
  <p>How can I specify time interval in which ASP.NET Identity will generate same phone number confirmation token?</p>