0
我有一個登錄頁面，用戶被指示輸入他們的用戶名和密碼，它們都存儲在數據庫中。用戶名以純文本格式存儲，但密碼存儲爲MySQL數據庫中含鹽的哈希密碼。我使用了Chris Duran的crackstation website和youtube video的C＃代碼示例。我成功地能夠註冊用戶並獲得他們的密碼被散列並存儲在MySQL數據庫中。驗證輸入的用戶密碼匹配從登錄頁面的數據庫散列密碼c＃asp.net
我有一個簡單的登錄頁面，其中包含電子郵件地址的文本框以及用戶必須輸入的密碼的文本框。我的登錄按鈕有一個點擊事件。我爲我的登錄頁面的代碼後面的代碼如下：
protected void btnlogin_Click(object sender, System.EventArgs e)
{
char activation;
if(Request.QueryString["tokenNum"] != null)
{
using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
{
dbConnection.Open();
{
OdbcCommand dbCommand = new OdbcCommand();
dbCommand.Connection = dbConnection;
dbCommand.CommandText = @"SELECT tokenNum FROM srlsLogin WHERE user_email_pk = ? and user_password = ?;";
dbCommand.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
dbCommand.Parameters.AddWithValue("@user_password", txtPassword.Text);
dbCommand.ExecuteNonQuery();
OdbcDataReader dataReader = dbCommand.ExecuteReader();
while (dataReader.Read())
{
if (token == dataReader["tokenNum"].ToString())
{
updateActivationStatus(txtUsername.Text);
userRedirect(txtUsername.Text, txtPassword.Text);
}
else
{
test.Text = "You are not authorized to login! Please activate your account following the activation link sent to your email " + txtUsername.Text + " !";
}
}
dataReader.Close();
}
dbConnection.Close();
}
}
}
protected void updateActivationStatus(string email)
{
using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
{
dbConnection.Open();
{
OdbcCommand dbCommand = new OdbcCommand();
dbCommand.Connection = dbConnection;
dbCommand.CommandText = @"UPDATE srlsLogin set activation_status = 'Y' WHERE user_email_pk = ?;";
dbCommand.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
dbCommand.ExecuteNonQuery();
}
dbConnection.Close();
}
}
//Redirecting the user to correct page
protected void userRedirect(string username, string passcode)
{
Session["username"] = txtUsername.Text;
Session["password"] = txtPassword.Text;
//Session["password"] = PasswordHash.ValidatePassword(txtPassword.Text, "@slowhashsalt");
using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
{
dbConnection.Open();
{
OdbcCommand dbCommand1 = new OdbcCommand();
dbCommand1.Connection = dbConnection;
dbCommand1.CommandText = @"SELECT user_status FROM srlsLogin WHERE user_email_pk = ? and user_password = ?;";
dbCommand1.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
dbCommand1.Parameters.AddWithValue("@user_password", txtPassword.Text);
dbCommand1.ExecuteNonQuery();
OdbcDataReader dataReader1 = dbCommand1.ExecuteReader();
while (dataReader1.Read())
{
user_status = dataReader1["user_status"].ToString();
Session["userType"] = user_status;
}
if (user_status == "Participant")
{
Response.Redirect("/srls/StudentUser");
}
else if (user_status == "Coordinator")
{
Response.Redirect("/srls/CoordinatorUser");
}
dataReader1.Close();
}
dbConnection.Close();
}
}
private void LoginWithPasswordHashFunction()
{
List<string> salthashList = null;
List<string> usernameList = null;
try
{
using (OdbcConnection dbConnection = new OdbcConnection(srlsConnStr))
{
dbConnection.Open();
{
OdbcCommand dbCommand = new OdbcCommand();
dbCommand.Connection = dbConnection;
dbCommand.CommandText = @"SELECT user_email_pk, slowsalthash FROM srlslogin WHERE user_email_pk = ?;";
dbCommand.Parameters.AddWithValue("@user_email_pk", txtUsername.Text);
dbCommand.ExecuteNonQuery();
OdbcDataReader dataReader = dbCommand.ExecuteReader();
while (dataReader.HasRows && dataReader.Read())
{
if (salthashList == null)
{
salthashList = new List<string>();
usernameList = new List<string>();
}
string saltHashes = dataReader.GetString(dataReader.GetOrdinal("@slowhashsalt"));
salthashList.Add(saltHashes);
string userName = dataReader.GetString(dataReader.GetOrdinal("@user_email_pk"));
usernameList.Add(userName);
}
dataReader.Close();
if (salthashList != null)
{
for (int i = 0; i < salthashList.Count; i++)
{
bool validUser = PasswordHash.ValidatePassword(txtPassword.Text, salthashList[i]);
if (validUser == true)
{
Session["username"] = usernameList[i];
Response.BufferOutput = true;
Response.Redirect("/srls/", false);
}
else
{
lblMessage.Text = "User not authorized! Please try again!";
}
}
}
}
dbConnection.Close();
}
}
catch (Exception ex)
{
}
}
我有點新的C＃和asp.net和很困惑，我該如何使用Session [「密碼」]，我知道如果我有密碼的純文本版本存儲到數據庫表，它工作正常，但我想使用會話[「密碼」]檢查哈希密碼，以便當用戶放置文本密碼時，它可以檢查表中的哈希密碼並讓用戶進入他們的帳戶。
SELECT語句不會爲您輸入純文本密碼，它只會嘗試比較兩個字符串，所以會失敗。您必須自己哈希密碼（使用相同的鹽），然後將您獲得的散列結果與數據庫中存儲的散列結果進行比較。 –
請檢查[MCVE]以獲取有關應添加到帖子中的代碼數量/類型的指導。 –
@AlexeiLevenkov我看了一下關於代碼的鏈接，並將其編輯了一下。有幾次我在這裏發佈問題，我不確定在這裏是否有太多或者沒有足夠的代碼，所以我最終發佈了儘可能多的代碼來展示我在做什麼。 – skaur