ASP.NET Core 3.1 - Confirmed Email Address

This article will describe the implementation of a confirmed email address for a user. I will assume you have downloaded the ASP.NET Core 3.1 - Users Without Identity Project or created a new ASP.NET Core 3.1 Razor Pages project. See Tutorial: Get started with Razor Pages in ASP.NET Core. You should review the earlier articles of the Users Without Identity Project series.

UWIP v2 implements Email, EmailUppercase, EmailConfirmed, and UnconfirmedEmail properties for the AppUser and a new user registration page with an email address input.

Entities > AppUser:

[Required]
[StringLength(320)]
public string Email { get; set; }
[Required]
[StringLength(320)]
public string EmailUppercase { get; set; }
[Display(Name = "Confirmed")]
public bool EmailConfirmed { get; set; }
[Display(Name = "Unconfirmed Email")]
[Required(AllowEmptyStrings = true)]
[StringLength(320)]
public string UnconfirmedEmail { get; set; }

When a new user registers, an AppUser is created. The EmailConfirmed defaults to false, EmailUppercase is set with the Email.ToUpper() method, and UnconfirmedEmail is set to an empty string. UWIP v2 implements a unique index on EmailUppercase for user queries by email address.

Data > ApplicationDbContext > OnModelCreating:

builder.Entity<AppUser>().HasIndex(u => u.EmailUppercase).IsUnique();

An email is sent to the Email address with a link to a email confirmation page. The link includes an EmailConfirmation token based on the new AppUser's SecurityStamp and provided by the TokenService. The token is used to verify the user has access to the Email address. The email confirmation page sets the AppUser's EmailConfirmed to true if the token is verified.

Pages > Account > ConfirmEmail.cshtml.cs:

public async Task<IActionResult> OnGetAsync(int id, string code)
{
    if (id == 0 || string.IsNullOrEmpty(code)) return NotFound();

    var appUser = await _userService.GetAppUserByIdAsync(id).ConfigureAwait(false);
    if (appUser == null) return NotFound();

    if (await _tokenService.ValidateEmailConfirmationTokenAsync(appUser, code).ConfigureAwait(false))
    {
        if (!await _userService.ConfirmAppUserEmailAsync(id).ConfigureAwait(false))
            throw new InvalidOperationException($"An error occurred confirming an AppUser email.");
    }
    else
    {
        ModelState.AddModelError(string.Empty, "Invalid or expired code.");
        ShowInvalid = true;
    }                

    return Page();
}

When the token is invalid, the ConfirmEmail page displays further information using the ShowInvalid property.

Update 02/23/2021

I updated the article links.