Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Pete 213 posts 285 karma points
    Nov 27, 2012 @ 14:20
    Pete
    0

    Sending member their password, best practice?

    Hi

    I've written a small routine that sends a member their username/password, but it fails on "cannot retrieve hashed password".

    So what's the best practice for this? use the reset password method? or store passwords in clear text? or any others?

    Thanks, Pete

  • João Ferreira 19 posts 40 karma points
    Nov 27, 2012 @ 18:26
    João Ferreira
    0

    Hi Pete,

    I think that store passwords in clear text should be the last resource. Its true, doesn't seem that we have a method to return the the hashed passwords. On a project with similar functionality I end up using the reset password method creating a random strong password and send this to the users.

    Hope this helps you.

    Regards,

    João Ferreira

  • Barry Fogarty 493 posts 1129 karma points
    Nov 27, 2012 @ 21:55
    Barry Fogarty
    0

    Hi Pete,

     

    You can reset a password for the member and email it to them using the following steps:

    1. Use Membership.GeneratePassword() to generate a new random password
    2. Encrypt the new password and save it to the member object e.g. member.Password = EncryptPassword(newPassword) - a trick here is to use the existing umbraco users membership provider which has a method to Encode the password
    3. Email the member their new password
    4. For bonus points you can redirect the user to the Change Password page when they log in from you emailed link (using a parameter on the link, or by setting a flag on the member account)
            private static string EncryptPassword(string password)
            {
                var ump = new umbraco.providers.UsersMembershipProvider();
                return ump.EncodePassword(password);
            }
  • Morten Bock 1867 posts 2140 karma points MVP 2x admin c-trib
    Nov 27, 2012 @ 22:01
    Morten Bock
    0

    As others have said, never store passwords in clear text. Generate a new one for the user, and let him change it himself. 

Please Sign in or register to post replies

Write your reply to:

Draft