0

I have database with users table where i have many columns include passwords and usernames.

I decided to use asp.net login control and have few question.

Where does login control saves passwords?

Can i check is user valid with my database ?

Sorry im new in asp.net

3 Answers 3

5

Whatever you do, don't save passwords plain text in the database, and especially with authentication do not reinvent the wheel - it's hard to get right.

You should use the built in forms authentication for ASP.NET. Forms authentication using the SQL Membership provider does not save the password to the database, instead it generates a hash value that allows it to later verify if a typed in password matches the existing ones. This keeps your DBA or whoever else gets access to your database from running off with your users' passwords.

The verification can be done using the Membership API (i.e.Membership.ValidateUser())

Here's a blog post series on ASP.NET 2.0 Membership, Roles, Forms Authentication, and Security Resources (old but good)

And here another one on the Membership API: How To: Use Membership in ASP.NET 2.0

1

You should use ASP.NET's Membership API. You can read up on it in the following:

Anyway with the membership provider, the password is not stored plainly - it gets calculated into a hash (also salted).

Generally you can run aspnet_regsql to create the relevant membership tables (eg users, roles, membership). You can find the password hash/salts in the Memberships table under the Password and PasswordSalt columns.

1

The <asp:Login> control doesn't read or write user data directly. Instead, it relies on an implementation of the MembershipProvider interface. ASP.NET comes with a standard provider called SqlMembershipProvider that uses its own tables in SQL Server. That class is not sealed, so you can extend it and override methods to access data from your desired locations, etc. Then you modify web.config to tell ASP.NET to use your new provider.

Here are links to two MSDN articles with details about implementing your own MembershipProvider:

http://msdn.microsoft.com/en-us/library/f1kyba5e%28v=vs.100%29.aspx

http://msdn.microsoft.com/en-us/library/44w5aswa.aspx

FWIW, the standard Membership interface has some significant deficiencies, particularly for large sites -- but that's a topic for a different question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.