ansaurus

Question

MembershipPasswordFormat.Hashed? How does this work?

Answer 1

+1 A:

Not sure, but I think passwords are saved in plain text because 'password retrieval' is enabled. You can disable this by setting <membership ... enablePasswordRetrieval="False"/> in Web.config.

Tadas 2010-01-11 09:42:54

Even though i tried to turn this option to false, the hash couldn't make it to the database... I don't know where the problem is.

DucDigital 2010-01-11 09:53:09

Answer 2

+1 A:

It's an option on the provider in the XML config. The docs show that you just set "passwordFormat='hashed'".

Noon Silk 2010-01-11 09:44:08

MembershipPasswordFormat.Hashed -> i go straight for this in my config

DucDigital 2010-01-11 09:46:15

And it's not working? What provider are you actually using? The SqlMembershipProvider? Check the source code for it, and see how it makes use of that field.

Noon Silk 2010-01-11 09:47:22

Actually, im using my own Provider, i forgot to mention abouve, can you send me a source for the CreateUser method?

DucDigital 2010-01-11 10:00:12

I think there could be the problem from my code that might submit the password directly to database, but where can i find the method to hash the password before i can submit it to my database? That's might be the problem for this case.

DucDigital 2010-01-11 10:05:40

Yes, that's definitely the problem. In that case you just want to learn how to hash the password before setting it. Hash it with SHA-256 or above: http://msdn.microsoft.com/en-us/library/system.security.cryptography.sha256(VS.71).aspx, there are plenty of examples how to do it (take the bytes that you get, and convert into Hex (base16) and store.

Noon Silk 2010-01-11 10:09:47

Answer 3

+1 A:

This is specified in the Membership Provider configuration of your webconfig, using the add element:

<!-- SqlMembershipProvider syntax -->
<add name="string" 
  type="string" 
  connectionStringName="string"
  applicationName="MyApplication"
  commandTimeout
  description
  enablePasswordRetrieval="false"
  enablePasswordReset="true"
  passwordFormat="Hashed"
  minRequiredPasswordLength
  minRequiredNonalphanumericCharacters
  passwordStrengthRegularExpression
/>

The default algorithm is SHA1, as defined in the membership provider, but you can override this if you want to using the hashAlgorithmType attribute:

<membership
  defaultProvider="provider name"
  userIsOnlineTimeWindow="number of minutes"
  hashAlgorithmType="SHA1">
  <providers>...</providers>
</membership>

For more details on providing your own algorithm, see "Mapping Algorithm Names to Cryptography Classes".

Note that the format overrides things like password retrieval - hashed passwords can't be retrieved, and a provider should return an exception if GetPassword is called on them when the password is hashed (see EnablePasswordRetrieval property).

If you have written your own MembershipProvider, I suggest you take a look at the "How to: Sample Membership Provider Implementation", especially the methods EncodePassword and UnencodePassword.

Zhaph - Ben Duguid 2010-01-11 10:08:17

Yes, i've worked out to include generation of hashcode at CreateUser and ValidateUser, ChangePassword. these 3 method used password so it's nessesary to hash all of them.

DucDigital 2010-01-11 13:47:11

Yes - each of those will need to call into the EncodePassword method.

Zhaph - Ben Duguid 2010-01-11 14:10:36

ansaurus

tags:

views:

answers:

MembershipPasswordFormat.Hashed? How does this work?

related questions