Can you validate an inactive user's password in ASP.NET's membership system?

Question

I am creating an activation form for newly-created users in ASP.NET's membership system. When the user is created I send an email with a link to an activation page. However, before the user is activated, I want to verify their user name and password, so I have them enter their credentials into text boxes.

However, based on what I've read and the behavior I am seeing, it appears that I have to activate the user before I can test the password, either with FormsAuthentication.Authenticate or Membership.ValidateUser. I think this is a potential security weakness - is there any way around it?

Thanks,

Graham

Answer 1

The activation link in their email should contain a long (32 character for example) unique and random ID, such as a GUID, that expires once activated (also expires within a short time-period if not activated). That ID might be potentially guessed, but if you believe that could be guessed, the username and password chosen by the user would have been guessed years before the GUID.

On the other hand, if you really want to do it another way, send them an activation "code", redirect them to an activation page on your site, ask for the username, password, and activation code. On the backend, activate the account, then check the user/pass validity, if invalid, disable the account. Else, redirect them letting them know their account was activated. All done in an "atomic" process.