how to validate usename and password from a text file form

Question

I have a login form that has Username and password as inputs from user and I want to validate these login credentials from a text file. How can I do it? I know how to write data and read data..but how to read only specific data.or check whether username password combination exists or not.

Answer 1

Skipping over the bad practice of storing passwords in a text file (especially if it isn't encrypted) you will need to come up with some sort of file format.

A very basic file could be like an ini file that you read:

[users]
username1=password1
username2=password2

Your algorithm would look for the [users] header, then read each line, split the line on the equal sign and compare the information and keep reading until you find a match, the end of the file, or possibly another section.

I'm not sure if you have ever worked with user authentication before but it is considered bad practice to store passwords in plain text because of the serious security issue if they are compromised. You generally want to use a one-way hash (like SHA-1 or SHA-256) to hash the users password (possibly with a known salt) and send that to your application and store that instead. That way you never know the actual password even if you are compromised in some way.

Answer 2

Is there any reason you have to use a plain text file? As Joshua says this is a poor way to store security information.

In .NET a standard approach is to use an application configuration file to store username/password (eg. app.config or web.config) and encrypt the password using the Data Protectction API (DPAPI) or the System.Security.Cryptography.ProtectedData class.

Jon Galloway provides a decent tutorial on how to do this.