I'm starting to size up a project where I feel security needs strike a little closer to home. What tools and techniques could I look at to attempt to raise an alarm when a valid login is used, but the owner of the login has given it away or had it stolen. I would prefer ASP.NET, then MVC 3, oriented stuff.
View 5 RepliesIam new to asp.net.in my web page iam validating user information such as fname,lname,sex,add and also login (to register to website)information emailid and password.here iwant to check email adrress (availblity) and tht iam doing it fine. but when iam validating all the textbox,which are there before emailid something like this
fname:
lname:
sex:
login details
emailid: check (buttonto check email availiblity)
password:
retype password:
submit(button)
iam using validation controls for all the text boxes , when iam using my tab to enter the values it w,l give me alll error messege until i fill it.and when i reach email textbox and check availblity then i cant check untill i fill the password and retype password texboxes..i can only check the email availblity only when al the fields are valid.but i want to valid the emailid before i could enter password and retype password?
My users like to upload password-protected Word documents into our custom document management system. I'd like to add a validation to check for the password and refuse the upload if it has a password.
Automating Word - with COM interop - is out of the question because this is a server side application.
public FilePathResult GetFileFromDisk(int id){ var file = dbSample.FileStores.Where(f => f.FileID == id).FirstOrDefault(); string path = Server.MapPath(@"~Images"); string fileName = file.FileUrl;.....
return File(path + fileName, file.MimeType, file.FileName);}hey I have this code for getting file from my server.In some downloader like IDM we have a SiteLogin,we can input usernameand password in your downloader,how can i retrieve from this to check this Username is exists from my database.
I am a newbie and using Visual Web Developer 2008 Express Edition developing a website with some SQL database and a membership folder.
The membership folder security was set via Website/ASP.NET Configuration and with Permission Deny for Anonymous users, and a user id and password was created.
However when running the website and login with the created userid and password, it failed to log in with error message "Your login attempt was not successful. Please try again." I suspect that the system could not find the ASPNETDB.MDF even though it is in the App_Data folder.
I have separately developed another website with Membership and User Login by following the example in ASP.NET Walkthrough in Learn Web Devbelopment, and it works ok.
I am trying to implement a small site which requires users to login using Forms based authentication. I have followed the tutorials found on various sites on the net and in particular the one at [URL]
This enabled me to get a sample environment in place but it seems as though I am having a problem authenticating a user for which I know the username and password are correct.
I have a ASP.Net 3.5 site with my login.aspx form in a folder named login, my default.aspx in the root of the site and my protected content in a folder called main.
I am authenticating against a SQL Server Express database, so I have ran the aspnet_regsql.exe command to populate my database.
I have added the following authentication/authorization lines to my web.config
<authentication mode="Forms">
<forms loginUrl="~/login/Default.aspx"
protection="All"
timeout="30"
name="AppNameCookie"
path="/FormsAuth"
[code]...
I believe that my connection string and my database are ok because if i use the ASP.NET Configuration from within Visual Studio I can create and manage my users and I can also see them in the tables in the SQL Server. Also if I do enter any incorect credentials in my login page the page tells me that the password is incorrect.
A question has been raised concerning password recovery revealing valid user ids. Stage 1 of the password recovery asks for a userid and when progressing to stage 2 will display an error message 'Invalid user id'. In theory this would allow valid user id'sto be identified.Is there a setting we are missing? Something that would allow the user id and question to be asked, then a message saying the 'User/Question combination is invalid'.
View 2 RepliesI have a domain controller on windows 2008 server R2, The users are able to modify their password through a web page. Once it's done, the users are still able tu use the old password as well as the new one at the next logon. The old password is still active only one time after the change, after that it's no more possible to use it...
I invoke the "ChangePassword" function.
Is it a parameter to configure on the server ? Is it cached somewhere on the computer of the users ?
Here is my code:
[Code]....
I wanted to show message "NOT valid user"; when user provide wrong userid/password ...but it does not showing any label in it..
Code:
public string Checkuser(string value1, string value2)
{
ExecuteTSQL ts = new ExecuteTSQL();
DataSet ds = ts.SelectQueryDS("select * from tbl_user where USERNAME =" + "'" + value1 +"'" +" and password1 = " +"'"+ value2+ "'" );
if (ds.Tables[0].Rows.Count > 0)
[code]....
I can recover my password but when I try to change my password to something a bit easier to remember it gives me:
Password incorrect or New Password invalid. New Password length minimum: 7. Non-alphanumeric characters required: 1.
When a user that has their IE set to save passwords hits my "Reset Password" form, the first text box set with TextMode set to "Password" is populated with the users saved password. Understandable, this is not the affect I would like as this is their "old" password. I cannot set the text of a text box with mode set to "Password" (naturally). Does someone know how to suppress or clear this value when IE is saving passwords?
View 4 RepliesDoes anyone has a solution (sample code) for the following features:
Create a randomGuid/Cryptographically strong random number Send a unique URL containing the random number to the user's email address When confirmed, the user is asked to change password
My provider is currently parametrized this way:
[code]....
The security issues with this type of procedure have been discussed here before.
I am using Forms Authentication in a new ASP.NET 3.5 Application.I have created the Tables in my database and run the Web Site Administration Too.When I try to create a user I get a password error no matter what I throw at it and I am becoming sure of that this is a symptom of an a setup error and not a password problem.One of the things that I notice is that my aspnet_Applications is empty and I am not sure what is supposed to fill it.I have tried to delete all the aspnet tables and done the procedure again but with the same result.
View 1 RepliesI am using the below post to encrypt and decrypt the password.
ENCRYPT POST
Now my code is working for Encryption. But now what I want is,
When I am using Forgot passwprd functionality, I want to send the decrypted password to the respective user in the Email.
In my database table the password is saved in the Encrypted format.
I have the code decrypt code from the above mentioned post, the question is where to place in the below code so that it will decrypt it properly
Here is my code:-
protected void btnSubmit_Click(object sender, EventArgs e) {
DataSet ds = new DataSet();
using (SqlConnection conn = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["DefaultCSRConnection"].ConnectionString)) {
conn.Open();
[Code] ....
My company has some unique password policies (such as a pwd cannot be re-used for 6 months, aside from the must include #, special character, upper & lower case)Can anyone suggest how to go about ensuring that a new user's password complies with these policies (using forms authentication in .net 3.5 framework)?
View 2 RepliesI using change password control, how can i change the password without enter the current password?
View 8 RepliesURL...how we can sending formatted email now in my Login.aspx page i have Textbox that when users forget their password they should type their Username on the textbox and after that click on send button.I want when users click on send button their user name that they type in textbox be on the email that send to me .
View 1 RepliesI'm using the ChangePassword method of membership provider to change the password and one of the requirement before calling the ChangePassword is to retrieve the current password. But I'm getting error:
padding is invalid and cannot be removed
below is my web.config:
[code]....
I have a web form, which is to allow user to reset their password. When I clicked on the button, I got this error
"Input string was not in a correct format."
The code behind the button is:
[Code]....
When the user types in the new password, this new password will be hashed upon clicking the button and saved into the database.
I have written a javascript code for handling the password functionality. The scenario is: when user wants to change the old password, he cannot fill the same old password again. I have written the code. But even the simple alert of blank textbox is not working. See the code for reference:
Javascript code:-
<script type="text/javascript">
function ltrim(str) {
var reg
reg = /^s+/g
return str.replace(reg, "")
}
function rtrim(str) {
[Code] .....
aspx code:-
<tr>
<td class="auto-style1">Old Password</td>
<td class="auto-style2">
<asp:TextBox ID="txtOldPassword" runat="server" TextMode="Password" class="txtcareer"></asp:TextBox>
<asp:RequiredFieldValidator ID="reqtxtOldPassword" ControlToValidate="txtOldPassword" runat="server" ErrorMessage="*"></asp:RequiredFieldValidator>
[Code] ...
Why this is not working...
I had been trying to solve this but there is a hidden key i wish someone point me to.
I had a simple membership database with users in first the Membership Provider configured for clear password to retrieve the original password .
Now a new requirement say that the password must be hashed and reset .
I configure the Membership password to hash , and Implemented the Reset Password Module.
My problem is as follow.
If the user is new registered user with the new configuration the password and the security answer is hashed.
also when I go and reset the password it continue to be hashed.
Now I thought that with new configuration if any previous user with clear text configuration , If he use the password Reset module , because my configuration now is hashed , I expected that the new password and security answer will be hashed . what happen is old user continue in clear text even if the configuration is hashed. so If I had new users everything is fine.
old users Membership Provider somehow know they had been stored in clear text and it keep change password and security answer in clear text . If I delete this user and create it , Membership Provider understand that everything will be hashed. I need to know how it know this , I need to migrate users not to delete and recreate users .
Also if there are no solution for that , I wish Microsoft Consider it in future cause it is a real user scenario, that can happen imagine a business system that related to membership user Id , deleting users and recreate them is not a solution .
I need a control that will accept an email address and password/verify with a password strength indicator.
Has anyone seen a similar type control?
I just begin creating a website for an organization. First page to be displayed in the login page. I dont have any knowledge in ASP.NET Security. On Login page, i want to display UserName field as disabled with the useralias of the user who currently logged into Windows. Password user has to provide and it should be that user's windows password.
How do i validate that password that user has entered is his windows password?
i am generate random password and show it in a textbox. when i am set textbox property textmode to password then it doesn't show in textbox but when i set it singleline then password shows in textbox. I am using following code --
textbox1.attributes.add("value",passwordvalue);
for show i am using --
textbox1.text = textbox1.attributes["value"].tostring();
Same happing with when i edit record. password doesn't show in textbox.
how to apply compare validater for password and confirm password in ASP.NET MVC2.
View 2 Replies