Summary

Introduces a "single active token" policy for password reset, email confirmation, and change-email flows by adding three new token providers backed by AbpSingleActiveTokenProvider.

How it works

Each time a new token is generated, a SHA-256 hash is stored in user.Tokens using a fixed internal login provider [AbpSingleActiveToken] and a key of {ProviderName}:{purpose}. On validation, the incoming token is re-hashed and compared against the stored hash using a constant-time comparison. Issuing a new token overwrites the hash, immediately invalidating all previously issued tokens for that purpose.

The bracketed [AbpSingleActiveToken] login provider name clearly distinguishes these internal entries from real external login providers (e.g. Google, GitHub) stored in the same AbpUserTokens table — following the same convention used by ASP.NET Core Identity's own [AspNetUserStore] internal provider.

Example rows in AbpUserTokens:

After a successful operation:

• Password reset / Change email – the SecurityStamp is updated by ASP.NET Core Identity, which causes all outstanding tokens for the user to fail base validation. No manual cleanup is needed.
• Email confirmation – ConfirmEmailAsync does not update the SecurityStamp. Callers that require single-use semantics must explicitly revoke the hash:

  var result = await userManager.ConfirmEmailAsync(user, token);
  if (result.Succeeded)
      await userManager.RemoveEmailConfirmationTokenAsync(user);

New providers

All three are registered and set as the default providers in AbpIdentityAspNetCoreModule.

Configuration

Token lifespan can be customized via the respective options classes:

Configure<AbpPasswordResetTokenProviderOptions>(options =>
{
    options.TokenLifespan = TimeSpan.FromHours(1);
});

Configure<AbpEmailConfirmationTokenProviderOptions>(options =>
{
    options.TokenLifespan = TimeSpan.FromDays(1);
});

Configure<AbpChangeEmailTokenProviderOptions>(options =>
{
    options.TokenLifespan = TimeSpan.FromHours(6);
});