On p. 122. ForgotPassword action resets the password independently from the answer.

It seems likely, that Memebership.Provider.ResetPassword(username, secretAnswer) doesn't take into account the secret answer at all!

Does anybody else experienced this error, and can propose a solution.

What if the user forgot the username and password?

It would be better to get the e-mail address from the user instead of user name.

Thanks

Gabriel

Answer to my own question

The forgot password to work:

1. In the web.config file we would set the RequireQuestionAndAnswer=true

2. In the ForgotPassword action method we have to insert a Try/Catch:

if (!String.IsNullOrEmpty(secretAnswer))
{

try
{
string resetPassword = Membership.Provider.ResetPassword(userName, secretAnswer);
if (Membership.ValidateUser(userName, resetPassword))
{
FormsAuthentication.SetAuthCookie(userName, false);
return RedirectToAction("ChangePassword", new { resetPassword = resetPassword });
}
else
{
TempData["ErrorMessage"] = "Invalid Response";
return View();
}
}
catch (Exception ex)
{
TempData["ErrorMessage"] = ex.Message;
}
}