Question

If I setup my app to use forms authentication, and I specify the credentials in web.config like this:

<authentication mode="Forms">
  <forms loginUrl="~/LogOn" name=".ASPXAUTH" path="/" defaultUrl="~/AuthArea" timeout="2880">
    <credentials passwordFormat="MD5">
      <user name="user" password="user123" />
    </credentials>
  </forms>
</authentication>

How do I then, in my LogOn Action validate the credentials?

if (FormsAuthentication.Authenticate(model.UserName, model.Password)) {

Won’t I need to encrypt the user entered password using MD5? And if so, how do you do that?

Thanks.

Answer 1

You do not need to encrypt the password when you are using FormsAuthentication.Authenticate. Your password in the web.config will need to be encrypted in MD5 though. here is the code I use:

public static string EncryptToMD5(this string helper)
        {
            MD5 md5 = new MD5CryptoServiceProvider();
            return BitConverter.ToString(md5.ComputeHash(Encoding.Default.GetBytes(helper)));
        }