ログインページからの通常のパスワードでデータベースからのハッシュパスワードを確認するのに大きな問題があります。この2つのパスワードを比較してユーザーを検証する方法。登録ページのコードは次のとおりです。
protected void Button1_Click(object sender, EventArgs e)
{
SHA384CryptoServiceProvider sh = new SHA384CryptoServiceProvider();
byte[] plainbytes = Encoding.ASCII.GetBytes(TextBox2.Text);
var sha = sh.ComputeHash(plainbytes);
byte[] hashbytes = sh.Hash;
SqlConnection con = new SqlConnection(constr);
SqlCommand cmd = new SqlCommand("RegisterUser",con);
cmd.CommandType = CommandType.StoredProcedure;
SqlParameter param = null;
param = cmd.Parameters.Add("@username",SqlDbType.VarChar,10);
param.Value = TextBox1.Text;
param = cmd.Parameters.Add("@password", SqlDbType.VarChar, 20);
param.Value = BitConverter.ToString(hashbytes);
try
{
con.Open();
cmd.ExecuteNonQuery();
Label4.Text = "Successfully added account!!!";
}
catch (Exception ex)
{
throw new Exception("Exception adding account"+ex.Message);
}
finally
{
con.Close();
}
}
このパスワードをログインページからのパスワードと比較する方法...みんな助けて...
SALTを使用したHASHのコード：-
private static string CreateSalt(int size)
{
RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
byte[] buff = new byte[size];
rng.GetBytes(buff);
return Convert.ToBase64String(buff);
}
private static string CreatePasswordHash(string pwd, string salt)
{
string saltAndPwd = String.Concat(pwd, salt);
string hashedPwd =
FormsAuthentication.HashPasswordForStoringInConfigFile(saltAndPwd, "SHA1");
hashedPwd = String.Concat(hashedPwd, salt);
return hashedPwd;
}
protected void btnregister_Click(object sender, EventArgs e)
{
int saltSize = 5;
string salt = CreateSalt(saltSize);
string passwordHash = CreatePasswordHash(txtPassword.Text, salt);
try
{
StoreAccountDetails(txtUserName.Text, passwordHash);
}
catch (Exception ex)
{
lblMessage.Text = ex.Message;
}
}
private void StoreAccountDetails( string userName,string passwordHash )
{
SqlConnection conn = new SqlConnection(constr);
SqlCommand cmd = new SqlCommand("INSERT INTO Users VALUES(@userName, @passwordHash)", conn);
SqlParameter sqlParam = null;
sqlParam = cmd.Parameters.Add("@userName", SqlDbType.VarChar,20);
sqlParam.Value = userName;
sqlParam = cmd.Parameters.Add("@passwordHash ", SqlDbType.VarChar,50);
sqlParam.Value = passwordHash;
try
{
conn.Open();
cmd.ExecuteNonQuery();
lblMessage.Text = "User Added Successfully!!!";
}
catch( Exception ex )
{
throw new Exception("Exception adding account. " + ex.Message);
}
finally
{
conn.Close();
}
}
private bool VerifyPassword(string suppliedUserName,string suppliedPassword )
{
bool passwordMatch=false;
SqlConnection conn = new SqlConnection(constr);
SqlCommand cmd = new SqlCommand( "SELECT PasswordHash FROM Users WHERE UserName = @userName", conn );
SqlParameter sqlParam = cmd.Parameters.Add("@userName",SqlDbType.VarChar,20);
sqlParam.Value = suppliedUserName;
try
{
conn.Open();
SqlDataReader reader = cmd.ExecuteReader();
reader.Read();
string dbPasswordHash = reader.GetString(0);
int saltSize = 5;
string salt = CreateSalt(saltSize);
reader.Close();
string hashedPasswordAndSalt =CreatePasswordHash(suppliedPassword, salt);
passwordMatch = hashedPasswordAndSalt.Equals(dbPasswordHash);
}
catch (Exception ex)
{
throw new Exception("Execption verifying password. " +ex.Message);
}
finally
{
conn.Close();
}
return passwordMatch;
}
protected void btnlogon_Click(object sender, EventArgs e)
{
bool passwordVerified=false;
try
{
passwordVerified =VerifyPassword(txtUserName.Text, txtPassword.Text);
}
catch (Exception ex)
{
lblMessage.Text = ex.Message;
return;
}
if (passwordVerified == true)
{
lblMessage.Text = "Logon successful: User is authenticated";
}
else
{
lblMessage.Text = "Invalid username or password";
}
}