Question

I am using the SqlMembershipProvider and when the login is done, I am trying to check if the password is wrong and give a corresponding message.

The problem is that in code I cannot get the password because it is hashed; the same case occurs when it is encrypted. So, I can’t compare it with current password given by the user (I need to keep the passwords on server hashed or encrypted.)

This is a part of the code:

string pass = user.GetPassword("myAnswer");

if (!pass.ToUpper().Equals(Login1.Password.ToUpper()))
{
   Login1.FailureText = "Password is wrong !";
}

So, should I set the password as clear in SqlMembershipProvider and then implement my own encrypting password mechanism? Is this the right way? I am thinking that the SqlMembershipProvider framework should handle this case somehow.

Answer 1

Membership providers handle your concern by providing a method to validate hashed passwords:

if ( Membership.ValidateUser( txtUserName.Text, txtPassword.Text ) )
{
}