CODEWITHSUNDEEP
asp.net.netasp.net-web-apiasp.net-identitypenetration-testing
Mike Weston
Mike Weston

Reputation: 85

ASP.Net Identity Change Password account lockout does not work

I am using ASP.Net identity. In the changepasswordasync function an invalid old password does not trigger an account lockout, is there anyway to get this to happen? This was raised as low issue by Pen test.

Regards

Mike

Upvotes: 1

Views: 948

Answers (1)

ArslanIqbal
ArslanIqbal

Reputation: 629

You can do this by calling lockout function if user provides wrong old password

int userId = User.Identity.GetUserId();
IdentityResult result = await UserManager.ChangePasswordAsync(userId , model.OldPassword, model.NewPassword);
if (result.Succeeded)
{
    userManager.ResetAccessFailedCount(userId);
}
else
{
    //you can add logic if the call didn't succeeded because of incorrect old 
    password and then execute the following line
    userManager.AccessFailed(userId);
}

Upvotes: 2

Related Questions