How to check if password is valid? ASP.NET MVC Membership

Question

I'm using default asp.net mvc 4 membership system. User sends his username and password over ASP.NET Web API in plain text.

So I have his plain password, How to compare it with stored hashed password?

Is there a function takes a string and compares it with hashed one?

The direct answer is yes [Membership.ValidateUser] msdn.microsoft.com/en-us/library/… — Mark Jones
– Mark Jones, Commented Dec 28, 2012 at 17:56

Javier · Accepted Answer · 2012-12-28 04:40:49Z

You have to make sure that your web.config is properly setup to use membership. http://msdn.microsoft.com/en-us/library/6e9y4s5t%28v=vs.100%29.aspx

Also, I make sure to create a MachineKey in your web.config as well. http://msdn.microsoft.com/en-us/library/ff649308.aspx

The code that you would put in your controller would be similar to:

[HttpPost] public ActionResult Login(AuthenticationModel model, string returnUrl) { if (ModelState.IsValid) { if (Membership.ValidateUser(model.Username, model.Password)) { FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe); if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/") && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\")) { return Redirect(returnUrl); } else { return RedirectToAction("Index", "Home"); } } } }

With your model being similar to:

 public class AuthenticationModel { [Required] [Display(Name = "Username")] public string UserName { get; set; } [Required] [DataType(DataType.Password)] [Display(Name = "Password")] public string Password { get; set; } [Display(Name = "Remember Me?")] public bool RememberMe { get; set; } }

d219 · Accepted Answer · 2020-07-24 15:05:10Z

Well I had a similar request, and what I accomplished was store the password using 64-byte field then I generated a 32-byte salt and 32-byte hash, then extracted salt from DB and encoded the same username using that salt and if the resultant object is equal to the one in DB

This is the Method I used

 public static bool IsPasswordValid(string plainPassword, byte[] data) { var prf = KeyDerivationPrf.HMACSHA512; var saltBytes = new byte[saltSize]; var hashBytes = new byte[hashSize]; Array.Copy(data, 0, saltBytes, 0, saltSize); Array.Copy(data, saltSize, hashBytes, 0, hashSize); var verificationHashBytes = KeyDerivation.Pbkdf2(plainPassword, saltBytes, prf, iterationCount, hashSize); return hashBytes.SequenceEqual(verificationHashBytes); }

Collectives™ on Stack Overflow

How to check if password is valid? ASP.NET MVC Membership

2 Answers 2

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Related