Skip to content

Identity: Message for invalid username does not reflect actual permitted characters. #39375

@ascott18

Description

@ascott18

Is there an existing issue for this?

  • I have searched the existing issues

Describe the bug

The message for an invalid username is Username '{0}' is invalid, can only contain letters or digits. https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Extensions.Core/src/Resources.resx#L164-L167

However, this message is produced when the username contains any characters not included in AllowedUserNameCharacters, a value which defaults to alphanumeric plus -._@+.

Expected Behavior

At the very least I'd expect the error message reflect what's actually allowed by the defaults. Bonus points if it reflected what's configured by the developer, but this would be quite difficult due to the way that the allowed characters are configured.

Steps To Reproduce

Repro is trivial:

  • In an AspNetCore project w/ Identity, call UserManager<T>.SetUserNameAsync(user, "userName!")
  • Observe that the error states the username can only contain letters and numbers.
  • Change the username to userName@example.com, observe that no error occurs despite containing characters other than letters and numbers as stated by the validation message.

Exceptions (if any)

No response

.NET Version

6.0.101

Anything else?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-identityIncludes: Identity and providershelp wantedUp for grabs. We would accept a PR to help resolve this issue

    Type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions