ASP.NET Core Identity prevent user from using same password

Question

I have a project where I am using ASP.NET Core Identity (with IdentityServer4) for user authentication.

When I use ChangePasswordAsync to change password, it is allowing the new password to be the same as the current password. Is there a way to prevent this?

you could implement in the controller, if there's one, to prevent old password == new password. If you would like to implement on identity API itself, try stackoverflow.com/questions/42787120 . Moreover, i believe you might be intereseted in password reuse policy, for your reference: stackoverflow.com/questions/15065429 and stackoverflow.com/questions/48783202 — wuiyang
– wuiyang, Commented Nov 15, 2020 at 19:54
I was trying to avoid implementing password validator, but as I see now, there's no other option but using it. — Sarahbe
– Sarahbe, Commented Nov 16, 2020 at 4:34
using old password == new password. is not an option because it will compare the two passwords without validating the password. so if the user enters a random word(not the correct password) in current and new password, a warning will be shown, which doesn't make sense. — Sarahbe
– Sarahbe, Commented Nov 16, 2020 at 4:53

Kay Meister · Accepted Answer · 2022-04-29 06:50:20Z

0

Adding a custom password validator in which you can do a Login-Request with username + the new password.

If this Login is successful then the password hasn't changed.

answered Apr 29, 2022 at 6:50

Kay Meister

911 silver badge3 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET Core Identity prevent user from using same password

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related