Monday, 19 August 2013

Password handling in ASP.Net MVC 4

Password handling in ASP.Net MVC 4

I am developing an ASP.Net MVC 4 application. In one of my models I am
have a password property where I store a password needed to access a web
service. Having this property store the cleartext password means that the
cleartext password becomes visible in the URL when the associated view is
displayed, which cannot be allowed for security reasons. So I want to have
the property store the encrypted password and only decrypt it when it is
needed to pass to the web service. The problem I face is that I have a
form where the user can enter the password. I am using one of the asp.net
mvc 4 templates (Html.PasswordFor). In order for the user to enter the
cleartext password and for the form to receive it, the password I use here
must be cleartext. What I need is to be able specify two properties in the
model. One of them works with the cleartext password and another one works
with the encrypted password. For this form field, I need to use the
cleartext property but I do not want the cleartext password being
displayed in the URL. How can I prevent that? Is there some attribute I
can add to the property that will tell MVC not to automatically send it to
the view?

No comments:

Post a Comment