CODEWITHSUNDEEP
asp.netmembership-provider
DannyD
DannyD

Reputation:

ASP.NET Membership Provider - Validate Hashed Security Question/Answer

On a page I'm adding retrieve forgotten USERNAME

Step 1) Enter email address (Get account by email)

Step 2) Verify Security Question (they provide answer and I validate it)

Step 3) Send them an email with username

Step 2 is where I'm stuck. How do I validate the answer with what's stored in the database?

All values are hashed.

I see other questions posted similar to this but they don't answer the question, at least not clearly.

Upvotes: 2

Views: 1810

Answers (2)

Mitchel Sellers
Mitchel Sellers

Reputation: 63126

Looking at the provider, it does not expose any methods for you to perform your desired step two.

You will need to do the following.

  1. Create a stored procedure that will retrieve results based on the email and answer.
  2. As you mentioned since the answer is hashed, you will need to MD5 hash the user supplied values. (FormsAuthentication.HashPasswordForStoringInConfigFile would work for this)
  3. Call your stored procedure with the needed parameters to validate that the users information matches.

Upvotes: 1

slolife
slolife

Reputation: 19870

Like you said, the values in the DB are hashed, so in order to validate what the user typed in matches what's in the DB, hashed the value that the user entered and compare the two hashed values. If they are equal, it validates.

You basically need to hash the answer text before you compare it to the value in the database.

Also, be aware that sometimes the answer text is salted with a value before it is hashed, so the same steps would need to be taken when validating.

Upvotes: 2

Related Questions