CODEWITHSUNDEEP
asp.net-mvcauthentication
sunny days
sunny days

Reputation: 847

Dot net MVC secure Forms Authentication

In my dot net MVC application, I have a Login page where user enters username and password. On clicking submit button the username and password are sent in plain text over the wire. Is there a simple way in which I can send encrypted username/passwords from the login form and decrypt then in the controller on server side. OR if there is any simpler way to prevent passwords being sent in plain text? Thanks.

Upvotes: 1

Views: 517

Answers (1)

Darin Dimitrov
Darin Dimitrov

Reputation: 1038710

Just use HTTPS, it's what it is designed for and it will ensure that the username and password won't be sent in clear text over an unencrypted channel.

Also in your web.config you could require SSL for the authentication cookie which will ensure that it will never be transmitted over a non-encrypted channel.

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="2880" requireSSL="true" />
</authentication>

Upvotes: 2

Related Questions