Skip to content

Identity: Message for invalid username does not reflect actual permitted characters. #39375

@ascott18

Description

@ascott18

Is there an existing issue for this?

  • I have searched the existing issues

Describe the bug

The message for an invalid username is Username '{0}' is invalid, can only contain letters or digits. https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Extensions.Core/src/Resources.resx#L164-L167

However, this message is produced when the username contains any characters not included in AllowedUserNameCharacters, a value which defaults to alphanumeric plus -._@+.

Expected Behavior

At the very least I'd expect the error message reflect what's actually allowed by the defaults. Bonus points if it reflected what's configured by the developer, but this would be quite difficult due to the way that the allowed characters are configured.

Steps To Reproduce

Repro is trivial:

  • In an AspNetCore project w/ Identity, call UserManager<T>.SetUserNameAsync(user, "userName!")
  • Observe that the error states the username can only contain letters and numbers.
  • Change the username to userName@example.com, observe that no error occurs despite containing characters other than letters and numbers as stated by the validation message.

Exceptions (if any)

No response

.NET Version

6.0.101

Anything else?

No response

Activity

adityamandaleeka

adityamandaleeka commented on Jan 7, 2022

@adityamandaleeka
Member

Triage: we should correct the default here, and also make the message customizable since users can modify the set of allowed characters in the username.

ghost

ghost commented on Jan 7, 2022

@ghost

Thanks for contacting us.

We're moving this issue to the .NET 7 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

ghost

ghost commented on Nov 17, 2022

@ghost

Thanks for contacting us.

We're moving this issue to the .NET 8 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

ghost

ghost commented on Nov 17, 2022

@ghost

Thanks for contacting us.

We're moving this issue to the .NET 8 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

Ingmar-Paetzold

Ingmar-Paetzold commented on Dec 10, 2022

@Ingmar-Paetzold

I just typed in an example from a Adam Freeman's book, where .AllowedUserNameCharacters are set to lowercase letters a-z only.
The default error message "... can only contain letters or digits" is definitely misleading, since no digits allowed. That would drive possible users crazy. (OK, granted, a site that only allows lowercase letters for user names probably needs to think about usability as well...)
Nevertheless, when customizing the usable alphabet is possible, then customizing the error message should be as well, allowing to refer to the special rules. Or is it already changeable?

added
help wantedUp for grabs. We would accept a PR to help resolve this issue
on Nov 19, 2024
lokisinary3d

lokisinary3d commented on Dec 4, 2024

@lokisinary3d

i got this error: Username is invalid, can only contain letters or digits.
if i add the user name field in registration and try to use user name like this: test user
but if i use: testuser
i do not see the error and found out that we cannot have space between the user name because it treating UserName as email also.
If any one know how to fix this provide the solution.

sander1095

sander1095 commented on Dec 17, 2024

@sander1095
Contributor

I wouldn't mind having a look at this in the new year, however, I would like to hear from the ASP.NET Core team what kind of solution they'd like.

  • Do we need to change the current default sentence?
  • Does the message need to become customizable, somehow?
  • Or would it need to change automatically based on the AllowedUserNameCharacters?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-identityIncludes: Identity and providershelp wantedUp for grabs. We would accept a PR to help resolve this issue

    Type

    Projects

    No projects

    Relationships

    None yet

      Development

      Participants

      @adityamandaleeka@danroth27@ascott18@sander1095@TanayParikh

      Issue actions

        Identity: Message for invalid username does not reflect actual permitted characters. · Issue #39375 · dotnet/aspnetcore