Home/ Questions/Q 8827057
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-14T07:17:28+00:00

I’m looking at writing a basic login page for an ASP.NET website, and all

  • 0

I’m looking at writing a basic login page for an ASP.NET website, and all the tutorials I’ve seen basically explain the following steps:
1. Create a form with username and password text boxes, and a login button.
2. Hook up the login button to an event that will call a validate function, passing in the data from these 2 textboxes.
3. Compare the data in these textboxes in some secure fashion to login info in a database, or elsewhere.
4. Return to the client some results, or redirect based on #3.

All the security information I can find refers to things that happen in #3. My concern is the transition from #1 to #2. Won’t the data be sent over an http post in clear text? Couldn’t someone just run a tcp trace or wireshark (ethereal), inspect the packets, and see the username and password clear as day? Must I buy an SSL cert to prevent this? Is there something in .net already that will pass this info hashed in some way, if not encrypted?

Thanks,
rj

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team
    Must I buy an SSL cert to prevent this?

    Yes, to make it secure you need to take care two things.

    1. The pages must be over ssl, so the name and password must be transmitted securely.
    2. The credential cookie must also be ONLY over ssl, and of course encrypted.

    More to read about:
    Can some hacker steal the cookie from a user and login with that name on a web site?
    Different users get the same cookie – value in .ASPXANONYMOUS
    How serious is this new ASP.NET security vulnerability and how can I workaround it?

    • 0