Asp.Net login in c# application

Question

I have an Asp.Net web application which uses Asp.Net Membership to login. Now I am building a desktop-application and I want the users to login in the desktop application securely using their website account.

I started with a WCF service on the web, the username, password hashed with SHA256, but now I don't know how to check if the password is correct. Asp.Net Membership also use a salt to the store the passwords. How can I do this?

And you're using ASP.NET membership provider as back end for service ? — Ondrej Svejdar
– Ondrej Svejdar, Commented Nov 11, 2013 at 14:36

fejesjoco · Accepted Answer · 2013-11-11 14:54:24Z

1

I would create a WCF service inside the ASP.NET webapp, which accepts cleartext username and password, and of course use transport-level encryption. In this service, I would call the MembershipProvider's ValidateUser() method.

Or you could implement a more secure authentication mechanism, but in that case, you should use your own MembershipProvider, because the default provider only accepts a cleartext password, and whatever it does with that is a secret, kind of.

The trick is that if you put your WCF service inside your webapp, then it will behave just like your browser clients. If you're using HTTPS for browser clients, then use the same HTTPS channel for WCF, and you're fine.

edited Nov 11, 2013 at 14:54

answered Nov 11, 2013 at 14:44

fejesjoco

12k4 gold badges39 silver badges65 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Nițu Alexandru Over a year ago

I think I will use the first method, although I don't know to much about transport-level encryption. Thank you!

fejesjoco Over a year ago

If you use passwords, you should already be using the HTTPS protocol, which provides transport-level encryption. It's not the easiest thing to setup WCF to use HTTPS, but there are many guides for that and it should work just fine.

Nițu Alexandru Over a year ago

I use passwords, but I am not using HTTPS.

fejesjoco Over a year ago

Well then, you should :). But of course, you can do it all on HTTP, too, it will work.

Nițu Alexandru Over a year ago

I can't use, because the host can't. The problem is it need to be secured, so with HTTP the password and username will be plain text (not OK).

|

Collectives™ on Stack Overflow

Asp.Net login in c# application

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related