Best approach: Set/change password dialog

Question

Hi

I have a usercontrol which is responsible for presenting creation and change of users. The usercontrol is bound to an entity delivered by a RIA Service:

[MetadataType(typeof(User.UserMetadata))]
public partial class User
{
    internal class UserMetadata
    {
        protected UserMetadata() {}

        [Required]
        public string Name { get; set; }

        [Exclude]
        public string PasswordHash { get; set; }

        [Exclude]
        public int PasswordSalt { get; set; }

        [Required]
        public string ShortName { get; set; }

        [Include]
        public IEnumerable<UserRole> UserRoles { get; set; }
    }

    [DataMember]
    [RegularExpression("^.*[^a-zA-Z0-9].*$", ErrorMessageResourceName = "BadPasswordStrength", ErrorMessageResourceType = typeof(ErrorResources))]
    [StringLength(25, MinimumLength = 6)]
    public string NewPassword { get; set; }
}

When creating a new user, the field "NewPassword" is required - but when changing properties of an existing user, it is not (it is used for password-changes).

What is the best approach to solve this? I have several ideas, but they all feels a little bit crappy :-)

Thanks

Answer 1

It appears you are passing your current passwords back to the GUI. There is no need to ever do that. That would create a potential security hole

Suggest you treat password changing as a separate service call, not just a simple record editing exercise. RIA services supports Invoke Operations which are basically arbitrary direct-calls to your RIA service. The only restriction on Invoke operations is that they cannot return complex types (not a problem for this example).

Pass your current logged-in user identifier, the current password (encoded) and the new password (encoded) and do all the work server side. Return a simple success boolean value.

Just some suggestions, I am happy to see other people's ideas on this one :)