Validate password in asp.net

Question

I am using the SqlMembershipProvider and when the login is done, I am trying to check if the password is wrong and give a corresponding message.

The problem is that in code I cannot get the password because it is hashed; the same case occurs when it is encrypted. So, I can't compare it with current password given by the user (I need to keep the passwords on server hashed or encrypted.)

This is a part of the code:

string pass = user.GetPassword("myAnswer");

if (!pass.ToUpper().Equals(Login1.Password.ToUpper()))
{
   Login1.FailureText = "Password is wrong !";
}

So, should I set the password as clear in SqlMembershipProvider and then implement my own encrypting password mechanism? Is this the right way? I am thinking that the SqlMembershipProvider framework should handle this case somehow.

Wiktor Zychla · Accepted Answer · 2012-01-14 17:15:32Z

4

Membership providers handle your concern by providing a method to validate hashed passwords:

if ( Membership.ValidateUser( txtUserName.Text, txtPassword.Text ) )
{
}

answered Jan 14, 2012 at 17:15

Wiktor Zychla

48.5k6 gold badges83 silver badges114 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sergii Kudriavtsev · Accepted Answer · 2012-01-14 17:14:05Z

0

The correct approach is to hash incoming user password, retrieve correct hash from DB and compare hashes, not the open passwords.

answered Jan 14, 2012 at 17:14

Sergii Kudriavtsev

10.5k5 gold badges48 silver badges71 bronze badges

Collectives™ on Stack Overflow

Validate password in asp.net

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related