Username with German or French letters gets encoded and passes validation ASP.NET Core Identity

On .Net Core 3.0 Preview 3, Asp.NET Core Identity Template, register a user with username bernhard@günter.com Expected Validation responds that this is not an allowed character for a username since the default is public string AllowedUserNameCharacters { get; set; } = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+"; Result [e-mail] is stored in the db as username and email and displayed in the UI!

That is pretty unexpected for an old framework and a handicap in the current implementation. Probably this has been encountered in the past??

[kevinchalet]

ok I just found out that the old .Net framework outputs type=text while .Net Core type=email. I also found that FF does send the data correctly to the browser, so it seems to be a chromium issue.

Yep, that’s because the MVC 5.x templates use Html.TextBoxFor for the email/username field. If you switch to Html.EditorFor, it will take the EmailAddress attribute into account and you’ll see a similar behavior.

the bug you link to dates back to 2014, so I still think that should be fixed here to accommodate for chrome since the response from chromium has been a “won’t fix”.

At best, Identity’s UI could try to proactively “punydecode” the username/email fields back to their real Unicode representation and validate them after that. Whether it’s a good idea or something rather fragile is what @blowdart will have to determine 😄

[Ponant]

Still dwelling upon this issue. I found out that when client side validation is enabled we get some weird behavior:

For a@ü.com Client side validation enabled FF refuses the post with error “Please enter a valid email address” Edge same as FF Chrome allows the post and sends you the punycode a@xn–tda.com

For a@ü.com Client side validation disabled FF allows the post and sends the raw value a@ü.com Edge still silly, it refuses the post and displays its default error “You must enter a valid email address” Chrome allows the post and sends you the punycode a@xn–tda.com

In short, Chrome does not care about client side validation, whereas FF will work only if client side val is disabled, Edge refuses unicode altogether. Two problems:

1. Edge needs to fix this and accept unicode. Luckily the new Edge Chromium based project behave slike Chrome as of 04.2019
2. The js validation scripts do not like unicode, so these need to be adapted or else FF needs to punycode the entries that are evaluated by jquery validation+unobstrusive.

Any thought?