I use this code to use in login
Code:
FormsAuthentication.HashPasswordForStoringInConfigFile(txtPassword.Text, "SHA1")
My question is how about, i how can convert into a string where it display the user password so that i can send it to the user when he/she forgot it?
I am trying to make Login through webConfig but it is not working. When I click on Login with the user and pass it is not redirected to theAllowUsers page.
WebConfig
<authentication mode="Forms">
<forms loginUrl="~/RestrictedArea/Login.aspx" defaultUrl="~/AllowUsers.aspx" timeout="2880">
<credentials passwordFormat="Clear">
[code]...
Is this how hashed password stored in SQL Server should look like? This is function I use to hash password (I found it in some tutorial)
public string EncryptPassword(string password)
{
//we use codepage 1252 because that is what sql server uses
byte[] pwdBytes = Encoding.GetEncoding(1252).GetBytes(password);
byte[] hashBytes = System.Security.Cryptography.MD5.Create().ComputeHash(pwdBytes);
return Encoding.GetEncoding(1252).GetString(hashBytes);
}
EDIT: I tried to use sha-1 and now strings seem to look like as they are suppose to:
public string EncryptPassword(string password)
{
return FormsAuthentication.HashPasswordForStoringInConfigFile(password, "sha1");
}
// example output: 39A43BDB7827112409EFED3473F804E9E01DB4A8
Result from the image above looks like broken string, but this sha-1 looks normal....
i m trying to change my password. the password in database is in hash formatting. the class FormsAuthentication. is using for hash conversion. the password is indicating the same in if condition. but after if applying it suddenly go on else part , even the value on if condition is same.
View 2 RepliesI'm using the code below to authenticate a user in Active Directory, but the password is sending in clear text. How can I hash my password and then send it to Active Directory?
DirectoryEntry entry = new DirectoryEntry(path, username, pwd);
try
{
//Bind to the native AdsObject to force authentication.
object obj = entry.NativeObject;
DirectorySearcher search = new DirectorySearcher(entry);
search.Filter = "(SAMAccountName=" + username + ")";
search.PropertiesToLoad.Add("cn");
SearchResult result = search.FindOne();
if (null == result)
{
return false;
}
//Update the new path to the user in the directory.
_path = result.Path;
_filterAttribute = (string)result.Properties["cn"][0];
}
catch (Exception ex)
{
throw new Exception("Error authenticating user. " + ex.Message);
}
return true;
<system.net>
<mailSettings>
<smtp from="email@domain.com" deliveryMethod="Network">
<network clientDomain="www.domain.com" host="smtp.live.com" defaultCredentials="false" port="25" userName=" email@domain.com " password="password" enableSsl="true" />
</smtp>
</mailSettings>
</system.net>
This is the case where I need encryption for my password. I searched and googled much on the web but I can't be able to encrypt anymore.
I am trying to insert a string and random number into the database as hash sha1 then loggin in against it. the problem is if I use hash it wont login but if i dont use hash the login works fine... Code below.
insert hash into db
Dim user As New Label
user.Visible = False
user.Text = (myDataReader2.Item("username"))
MyConnection2.Close()
Dim MyConnection3 As New Data.SqlClient.SqlConnection("Data Source=xxx")
Dim mycommand3 As New Data.SqlClient.SqlCommand("Update Register SET [Password] = @password WHERE [username] = '" & user.Text & "' AND [email] = '" & email.Text & "'", MyConnection3)
Dim pass As String
Dim rnd As Integer, randomNum As New Random
rnd = randomNum.Next(1000, 10000)
pass = "Pass" & rnd
mycommand3.Parameters.AddWithValue("@password", FormsAuthentication.HashPasswordForStoringInConfigFile(pass, "SHA1"))
MyConnection3.Open()
mycommand3.ExecuteNonQuery()
login page
Sub Application_AuthenticateRequest(ByVal sender As Object, ByVal e As EventArgs)
' Fires upon attempting to authenticate the use
If Not (HttpContext.Current.User Is Nothing) Then
If HttpContext.Current.User.Identity.IsAuthenticated Then
If TypeOf HttpContext.Current.User.Identity Is FormsIdentity Then
Dim fi As FormsIdentity = CType(HttpContext.Current.User.Identity, FormsIdentity)
Dim fat As FormsAuthenticationTicket = fi.Ticket
Dim astrRoles As String() = fat.UserData.Split("|"c)
HttpContext.Current.User = New GenericPrincipal(fi, astrRoles)
End If
End If
End If
End Sub
Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs)
Dim myConnection As New SqlClient.SqlConnection
Dim myCommand As New SqlClient.SqlCommand
Dim intUserCount As Integer
Dim strSQL As String
myConnection = New SqlClient.SqlConnection("Data Source=jrome2.db.4961680.hostedresource.com; Initial Catalog=jrome2; User ID=jrome2; Password=Richard050283;")
strSQL = "SELECT COUNT(*) FROM Register " _
& "WHERE UserName='" & Replace(txtusername.Text, "'", "''") & "' " _
& "AND Password='" & Replace(txtpassword.Text, "'", "''") & "';"
myCommand = New SqlClient.SqlCommand(strSQL, myConnection)
myConnection.Open()
intUserCount = myCommand.ExecuteScalar()
myConnection.Close()
'Response.Write(intUserCount)
If intUserCount > 0 Then
FormsAuthentication.Initialize()
Dim strRole As String = AssignRoles(txtusername.Text)
'The AddMinutes determines how long the user will be logged in after leaving
'the site if he doesn't log off.
Dim fat As FormsAuthenticationTicket = New FormsAuthenticationTicket(1, _
txtusername.Text, DateTime.Now, _
DateTime.Now.AddMinutes(30), False, strRole, _
FormsAuthentication.FormsCookiePath)
Response.Cookies.Add(New HttpCookie(FormsAuthentication.FormsCookieName, _
FormsAuthentication.Encrypt(fat)))
Response.Redirect(FormsAuthentication.GetRedirectUrl(txtusername.Text, False))
Else
login.Text = "Incorrect Log In Information"
End If
End Sub
Private Function ValidateUser(ByVal strUsername As String, ByVal strPassword As String) _
As Boolean
'Return true if the username and password is valid, false if it isn't
Return CBool(strUsername = " & Replace(txtusername.Text, " AndAlso strPassword = " & Replace(txtpassword.Text, ")
End Function
Private Function AssignRoles(ByVal strUsername As String) As String
Dim myConnection As New SqlClient.SqlConnection
Dim myCommand As New SqlClient.SqlCommand
Dim intUserCount As Integer
Dim strSQL As String
myConnection = New SqlClient.SqlConnection("Data Source=jrome2.db.4961680.hostedresource.com; Initial Catalog=jrome2; User ID=jrome2; Password=Richard050283;")
strSQL = "SELECT COUNT(*) FROM Register " _
& "WHERE UserName='" & Replace(txtusername.Text, "'", "''") & "' " _
& "AND Password='" & Replace(txtpassword.Text, "'", "''") & "';"
myCommand = New SqlClient.SqlCommand(strSQL, myConnection)
myConnection.Open()
intUserCount = myCommand.ExecuteScalar()
myConnection.Close()
'Response.Write(intUserCount)
If intUserCount > 0 Then
Return "client"
Else
Return String.Empty
End If
End Function
Protected Sub LinkButton1_Click(ByVal sender As Object, ByVal e As System.EventArgs)
txtusername.Text = String.Empty
txtpassword.Text = String.Empty
End Sub
I'm attempting to create a pure t-sql representation of the default SHA-1 password hashing in the ASP.Net Membership system. Ideally, what I would get would be this:
UserName Password GeneratedPassword
cbehrens 34098kw4D+FKJ== 34098kw4D+FKJ==
Note: that's bogus base-64 text there. I've got base64_encode and decode functions that round-trip correctly. Here's my attempt, which doesn't work: SELECT UserName, Password, dbo.base64_encode(HASHBYTES('SHA1', dbo.base64_decode(PasswordSalt) + 'test')) As TestPassword FROM aspnet_Users U JOIN aspnet_membership M ON U.UserID = M.UserID
I've tried a number of variations on the theme, to no avail. I need to do this in pure T-Sql; involving a console app or something like that will double the work. So if anyone can supply what precisely the syntax should be to duplicate that password from the ASP.Net membership stuff
Is there a way of creating a hash key that can be used by our different servers for decrypting connection strings in web.config, and how would I do that?
View 1 RepliesHopefully someone knows a way to fix this issue, but here is my problem. I need to be able to recreate a md5 hash that will be the equivalent of the hash that php would generate.
The encoding I have tried is listed below. None of these will produce the same values.
UnicodeEncoding
UTF7Encoding
UTF8Encoding
UTF32Encoding
I have a File Uploader in my ASP.NET application Using C#, we can upload any type like images, documents, pdf etc.
I m storing it in the Filesystem and having only the Name of the File in DB.My doubt is can we store the entire file, images in DB. State me Which is good practice and why we need to use it.
Either file System Storage or SQL DB Storage.
I am looking to store a string field, a password, in a location that I can access within the code, but if you downloaded the code from a deployed place, you would not be able to access the password. Web.config is available for all to see, or else I would just slide it in there.
View 4 RepliesI have a problem with changing the password from Microsoft Access Database. I get an Error "No data exists for the row/column". The password in the database is encrypted and when I change the password it should be decrypting the password and new password should be updated with encryption again. I have following Encryption and Decryption Function:
Code:
Imports System.Collections.Generic
Imports System.Linq
Imports System.Web
Imports System.Text
[code]....
I am using web (asp.net 3.5). c#In my login form i accept username and password.what is best way of fecthing username and password from user and saving in sqlserver in terms of security .Is encription and decription only way? then how do i implement it?
View 8 RepliesI am trying to create a cookie for storing Username and Password.
This is so far I am :
[Code]....
But I am getting error :
[Code]....
I just installed VS2010 and opened the root machine.config and web.config files for review and I found some errors. In machine.config, the following line has errors in both entries for <Microsoft.VisualStudio.Diagnostics.ServiceModelSink.Behavior>. When I hover the cursor over them I get a tooltip text which displays: "The element 'endpointBehaviors' has invalid child element 'Microsoft.VisualStudio.Diagnostics.ServiceModelSink.Behavior'. List of possible elements expected: '...(list of options here)...'. The same problem happens for the second appereance in tag <serviceBehaviors>.
[Code]....
In web.config, there is a tag called <protocols> that has an error with a tooltip text that says "The element 'system.web' has invalid child element 'protocols'. List of possible elements expected: '...(list of options here)...'.
There are a bunch of hardcoded strings in a ASP.NET application.
eg. string constSetting = "XYZ";
There are a LOT of them. Is there a tool/plugin for Visual Studio 2008 to refactor it in such a way that the constant string goes into web.config and the above line gets replaced by the retrieved string from web.config app settings?
What it best location to store various configuration settings of a web site modules. Creating class (that inherit ConfigurationSection) that map the settings in web.config file?Or creating some DAL and BLL clases that work with database?
View 5 RepliesI would like to store a collection of strings in the web.config. This collection would vary in size over time. I would like to be able to pull all of the strings in the collection into an array or collection in code. (.Net 4, asp.net)
i.e.
<customCodes>
<VendorCode vendorName="Name1" code="1234567891234567891324567987ddd" isActive="true"/>
<VendorCode vendorName="Name2" code="1sadfsadf1234567891324567987ddd" isActive="true" />
<VendorCode vendorName="Name3" code="123456789dfadfdsaf3324567987d32" isActive="true"/>
</customCodes>
I could use appsettings with the strings all in one value but I would like to seperate it out for organizational reasons. Not using the key/value pair complicates things a bit. I am now getting a message that states "you can't have duplicate elements in a section"
We have a large multi tenanted website which requires thousands of lines of web.config to support it. As the system grows we are finding it more and more difficult to manage this configuration file.The system currently in place uses XSLT to generate the config but this solution seems to involve a lot of duplicated code (we have 12 deployment environments).
I am leaning towards putting the configuration data in the db so we can be sure that it's deployed with the application and that our release notes don't require the IT guys messing around with XML
What are better solutions we could use?
What I have write connection always in web.Config file and Why I can not write the connection in Application Variable ....
View 1 RepliesI am writing an app that has a bit of process flow to it. On the save of a record, I need to check some fields to make sure they are not null. If they are not null, I will update a 'SectionComplete' field to true.
The thing is, I would like to store my fields in the web.config. So, I would like to have a string in the appsettings section that has a list of field names that are required. Then in my method, I would call these fields out and check each one for the specific record id, and then update the database.
I would like to do this in the web.config so we could add/remove columns without having to redeploy.
For example: my required fields are name, id, and phone. For section one to be labeled complete, all of these fields would need to be not null.
web.config would have this entry:
<add key="Stage1Fields" value="name, id, phone"/>
I have implemented Membership and Role Provider in my web site. Membership and Role information is stored in database created from aspnet_regsql option.
I want to store the access rights given to the pages in ASP.NET Configuation option in Database inspite of web.config file and want to give page wise add, edit, view and delete rights that should also be stored in database.
Is there any inbuit class like Membership and Role to add page access rights?
I've created a website that allows users to register, log in, create tasks, be added to tasks. I want to the user to be able to add hours to these tasks, for a summary page that will contain a chart. I want to store all previous hours worked on the task so that the user will be able to view a chart on progress of the tasks? What would be the best way to go about implementing this? I'm using VB.
View 12 RepliesI'm preparing to deploy a ASP.NET web application. The target server has already a previous version of my web application with parameters specified on the web.config file.
In the new version of this web application, the web.config file contains new sections I would like they appear into the target web.config file on the server.
However I can't find the way to merge the new web.config sections into the existing web.config file ?
Does I have to do it programmatically, or is there a tool to merge the both files during installation ? (I'm using Web Setup Project).