Home/ Questions/Q 5976725
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-22T21:16:09+00:00

i’ve developed an intranet application and implemented an custom ASP.NET Membership Provider with Forms-Authentication.

  • 0

i’ve developed an intranet application and implemented an custom ASP.NET Membership Provider with Forms-Authentication. I thought it would be a good idea to log all failed login attempts in DBMS. Hence i’ve created a table with following model:

enter image description here

Now my question:

Is it good practise to store this for safety reasons or is it even forbidden due to data protection reasons(germany)? I’m storing the original passwords hashed in db but the wrong passwords(or correct pw with wrong username) in the log-table are in clear-text.

Somebody could argue that everybody with access to this table could get user’s passwords not alone for this application but for others too, because people who have forgotten their passwords (or their username) might try out others as well.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Not a good idea for users who misspell their user ID but give the correct password!

    • 0