Hiding a passwordhash field in EntityFramework

Question

Im using entity framework for a project and wishes it to behave in similiar way as my normal ado.net-project, where I never fetch the password hash from the database to avoid security leaks of secret information.

I´ve though of a couple of ideas

• one is to hide the field from partial class but I don't know if that is possible.
• Change the code generation template with an ugly if clause for that special case

Neither of those solutions stops the data from leaving the database I guess, just hides the fields with returning String.Empty or such. Is there any way to not enable that field at all but still have the possibility to add new users or change hash in a forgotten password feature.

Answer 1

You have a few options:

1. You can delete the Password property from your conceptual layer and EF won't select it from the database. (Just hit 'Delete' while you have the property selected in the designer.)
2. You can create a view in your DB and publish only a hash of the password (ie. a virtual column). An earlier question of mine might help you here.
3. You can make the accessibility of the Password property in your generated entity non-public. (Again, select the property in the designer and examine its properties.) Note of course that the password does leave the database with this option.

For the first two cases, you'll need a side channel for updating the password in the database - probably a stored procedure. The third option should allow you to update the password while keeping it hidden from everyday users, though of course it will be in memory so savvy users might still have access to it.