I have a web form, which is to allow user to reset their password. When I clicked on the button, I got this error
"Input string was not in a correct format."
The code behind the button is:
[Code]....
When the user types in the new password, this new password will be hashed upon clicking the button and saved into the database.
I had been trying to solve this but there is a hidden key i wish someone point me to.
I had a simple membership database with users in first the Membership Provider configured for clear password to retrieve the original password .
Now a new requirement say that the password must be hashed and reset .
I configure the Membership password to hash , and Implemented the Reset Password Module.
My problem is as follow.
If the user is new registered user with the new configuration the password and the security answer is hashed.
also when I go and reset the password it continue to be hashed.
Now I thought that with new configuration if any previous user with clear text configuration , If he use the password Reset module , because my configuration now is hashed , I expected that the new password and security answer will be hashed . what happen is old user continue in clear text even if the configuration is hashed. so If I had new users everything is fine.
old users Membership Provider somehow know they had been stored in clear text and it keep change password and security answer in clear text . If I delete this user and create it , Membership Provider understand that everything will be hashed. I need to know how it know this , I need to migrate users not to delete and recreate users .
Also if there are no solution for that , I wish Microsoft Consider it in future cause it is a real user scenario, that can happen imagine a business system that related to membership user Id , deleting users and recreate them is not a solution .
When a user that has their IE set to save passwords hits my "Reset Password" form, the first text box set with TextMode set to "Password" is populated with the users saved password. Understandable, this is not the affect I would like as this is their "old" password. I cannot set the text of a text box with mode set to "Password" (naturally). Does someone know how to suppress or clear this value when IE is saving passwords?
View 4 Repliesi have implemented asp. net membership authentication and one of my users has forgotten his password.
The passwords are hashed and when i try retrieveing his password i get the error that password retrieval is not available for hashed passwords.
Should i reset the password?
im using asp.net for my webpage. im also using the login control too. i want it so when the user types in the correct user name and password, it redirects to a new page called test.aspx. i dont want to use login view.
View 2 RepliesI have an ASP.NET application that requires impersonation as an administrator user. In web.config:
<identity impersonate="true" userName="administrator" password="password"/>
The customer complained about saving the password in clear text format. Is there a way to save the password here as hashed?
i m searching a way to compare the password in hash formatting. the saved password in database is in hash formatting and trying to change password. the changed password should be save in hash formatting as well. plz tell me the solution.protected
{
HashedPassword =
void btnSubmit_Click(object sender,
[code]...
I have a system where I salt and hash passwords before saving them to the database, using FormsAuthentication in asp.net
What I want to do is, rather than ask the customer for their password each time, I just want 3 random letters from their password. How can I compare this to the hash in the database? Will hashing still work in this case? From what I gather hashing is only designed to be a one way process and shouldn't be decrypted, so is checking 3 random letters for a hash even possible?
URL...how we can sending formatted email now in my Login.aspx page i have Textbox that when users forget their password they should type their Username on the textbox and after that click on send button.I want when users click on send button their user name that they type in textbox be on the email that send to me .
View 1 RepliesI am using the below post to encrypt and decrypt the password.
ENCRYPT POST
Now my code is working for Encryption. But now what I want is,
When I am using Forgot passwprd functionality, I want to send the decrypted password to the respective user in the Email.
In my database table the password is saved in the Encrypted format.
I have the code decrypt code from the above mentioned post, the question is where to place in the below code so that it will decrypt it properly
Here is my code:-
protected void btnSubmit_Click(object sender, EventArgs e) {
DataSet ds = new DataSet();
using (SqlConnection conn = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["DefaultCSRConnection"].ConnectionString)) {
conn.Open();
[Code] ....
I'm using a website as a frontend and all users are authenticated with the standard ASP.NET Membership-Provider. Passwords are saved "hashed" within a SQL-Database.Now I want to write a desktop-client with administrative functions. Among other things there should be a method to reset a users password. I can access the database with the saved membership-data, but how can I manually create the password-salt and -hash? Using the System.Web.Membership Namespace seems to be inappropriate so I need to know how to create the salt and hash of the new password manually.
View 4 RepliesMy company has some unique password policies (such as a pwd cannot be re-used for 6 months, aside from the must include #, special character, upper & lower case)Can anyone suggest how to go about ensuring that a new user's password complies with these policies (using forms authentication in .net 3.5 framework)?
View 2 RepliesI'm using the ChangePassword method of membership provider to change the password and one of the requirement before calling the ChangePassword is to retrieve the current password. But I'm getting error:
padding is invalid and cannot be removed
below is my web.config:
[code]....
I just begin creating a website for an organization. First page to be displayed in the login page. I dont have any knowledge in ASP.NET Security. On Login page, i want to display UserName field as disabled with the useralias of the user who currently logged into Windows. Password user has to provide and it should be that user's windows password.
How do i validate that password that user has entered is his windows password?
I can recover my password but when I try to change my password to something a bit easier to remember it gives me:
Password incorrect or New Password invalid. New Password length minimum: 7. Non-alphanumeric characters required: 1.
when user click forgot password it asked user name and email and send his password on his email.
How implement this task in asp.net. with datbase sql server.
I have to save user Credantials but I dont know how to save the password into the sql database
View 4 RepliesI have an asp.net website that requires users to login using their Active Directory credentials. All users of the website have AD accounts. Some of the users are at remote locations and share a common computer login (I know this is not recommended but it is what it is, I have no say in that). Every so often a user will log into my website and click the Remember Passwod box which causes the next person that comes along to not be prompted to log in. All users are on IE 7. I have tried having them go into tools and deleting the cookies, saved passwords, etc but when they go to my website they are still not being prompted to log in. I have recently migrated to IIS 7 and I understand there is a way to have the user enter the site through a custom form but I have not gotten that far yet. How can I make sure the users password is removed from IE?
View 3 RepliesI have written a javascript code for handling the password functionality. The scenario is: when user wants to change the old password, he cannot fill the same old password again. I have written the code. But even the simple alert of blank textbox is not working. See the code for reference:
Javascript code:-
<script type="text/javascript">
function ltrim(str) {
var reg
reg = /^s+/g
return str.replace(reg, "")
}
function rtrim(str) {
[Code] .....
aspx code:-
<tr>
<td class="auto-style1">Old Password</td>
<td class="auto-style2">
<asp:TextBox ID="txtOldPassword" runat="server" TextMode="Password" class="txtcareer"></asp:TextBox>
<asp:RequiredFieldValidator ID="reqtxtOldPassword" ControlToValidate="txtOldPassword" runat="server" ErrorMessage="*"></asp:RequiredFieldValidator>
[Code] ...
Why this is not working...
Iam new to asp.net.in my web page iam validating user information such as fname,lname,sex,add and also login (to register to website)information emailid and password.here iwant to check email adrress (availblity) and tht iam doing it fine. but when iam validating all the textbox,which are there before emailid something like this
fname:
lname:
sex:
login details
emailid: check (buttonto check email availiblity)
password:
retype password:
submit(button)
iam using validation controls for all the text boxes , when iam using my tab to enter the values it w,l give me alll error messege until i fill it.and when i reach email textbox and check availblity then i cant check untill i fill the password and retype password texboxes..i can only check the email availblity only when al the fields are valid.but i want to valid the emailid before i could enter password and retype password?
do you have validation using HTML5 and also I am using with Master Page.
View 1 RepliesI have a log in screen.
If the username and password do not match, it displays the message "invalid username/password" on the screen
But the cursor moves away from the password textbox. I want to cursor in the password textbox if the username/password is not correct
How to make a secure login page using sql database by matching a user name and password and redirect them to differnt page as admin and user
View 2 RepliesI have a form that is used to add and edit data. Based on a dropdown selection, the form is either prepopulated or left blank so you can add new data.
I have a password field that is set to TextMode="Password" and works fine when adding new data, it displays ***** as you type..
Now if you select from the dropdown and there is already a record on file, it populates the form to allow you to edit the information.. Now i DONT want to display the password in plain text, but i want to populate the field so if they make any changes all field data is kept and table is updated with all of it.
I already debugged the page and my variable is being set with the password, but the textbox doesnt even show the ***** for the password value.
Does anyone has a solution (sample code) for the following features:
Create a randomGuid/Cryptographically strong random number Send a unique URL containing the random number to the user's email address When confirmed, the user is asked to change password
My provider is currently parametrized this way:
[code]....
The security issues with this type of procedure have been discussed here before.
