Hi All,
am trying to use build a secure login page. I have written necessary functions and the registrations works fine (with secure hash + salt passwords created) but the verification never goes through. Can someone point me in the right direction?
Imports System.Data
Imports System.Data.SqlClient
Imports System.Security.Cryptography
Imports System.Web.Security
Partial Class logon
Inherits System.Web.UI.Page
Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load
End Sub
Private Shared Function CreateSalt(size As Integer) As String
' Generate a cryptographic random number using the cryptographic
' service provider
Dim rng As New RNGCryptoServiceProvider()
Dim buff As Byte() = New Byte(size - 1) {}
rng.GetBytes(buff)
' Return a Base64 string representation of the random number
Return Convert.ToBase64String(buff)
End Function
Private Shared Function CreatePasswordHash(pwd As String, salt As String) As String
Dim saltAndPwd As String = [String].Concat(pwd, salt)
Dim hashedPwd As String = FormsAuthentication.HashPasswordForStoringInConfigFile(saltAndPwd, "SHA1")
hashedPwd = [String].Concat(hashedPwd, salt)
Return hashedPwd
End Function
Private Sub storeAccountDetails(userName As String,
passwordHash As String)
Dim conn As SqlConnection = New SqlConnection("Server=(local);" + "Integrated Security=SSPI;" + "database=UserAccounts")
Dim cmd As SqlCommand = New SqlCommand("RegisterUser", conn)
cmd.CommandType = CommandType.StoredProcedure
Dim sqlParam As SqlParameter = Nothing
sqlParam = cmd.Parameters.Add("@userName", SqlDbType.VarChar, 20)
sqlParam.Value = userName
sqlParam = cmd.Parameters.Add("@passwordHash ", SqlDbType.VarChar, 50)
sqlParam.Value = passwordHash
Try
conn.Open()
cmd.ExecuteNonQuery()
Catch ex As Exception
' Code to check for primary key violation (duplicate account name)
' or other database errors omitted for clarity
Throw New Exception("Exception adding account. " + ex.Message)
Finally
conn.Close()
End Try
End Sub
Protected Sub btnRegister_Click(sender As Object, …