0

I have a asp.net MVC website that I've recently published on a web hosting service. Almost everything works great, the information that I get from my msSQL db is shown on the pages etc etc. But there's one problem. When I try to log in to my website, it won't work. Before I explain any further, you'll have to take a look at the following code which is how I authenticate a user login:

public ActionResult Login()
{
    return View();
}

[HttpPost, ValidateAntiForgeryToken]
public ActionResult Login(LoginModel model)
{
    if (ModelState.IsValid)
    {

        if (Repository.AuthenticateLogin(model.Username, model.Password.GetHashCode().ToString()))
        {
            FormsAuthentication.SetAuthCookie(model.Username, false);
            return RedirectToAction("Index", "Home");
        }
        else
        {
            TempData["WrongLogin"] = "The username or password you've entered is wrong. Please try again!";
            return View(model);
        }
    }
    else
    {
        return View(model);
    }
}

And the method "AuthenticateLogin(string username, string password) that is used in the if-statement above looks like this:

public static bool AuthenticateLogin(string username, string password)
    {
        using (var context = new SHultEntities())
        {
            return (from u in context.User
                    where u.Username == username && u.Password == password
                    select u).Any();
        }
    }

Now, as you can see, to authenticate a user, I am checking the entered username and password against any user in the database's user-table. If there is a match, the method returns "true", or else it returns "false". Yeah, you get it.

Well, the problem is, when I try to log in on my site I get the TempData["WrongLogin"] text, which means my AuthenticateLogin method must've returned false, which means that there must not have been any matches. But when I try this on my local project on my computer, with the same username and password, the AuthenticateLogin returns true.

If the problem was the connection to the database, the headers and contents that I retrieve from my database would not appear on the site. But it does. Also, when I update something from my local project and then go on my website, the updated information appears. So, the only problem is that I can't log in.

This is driving me crazy and I would really appreciate some help.

EDIT: Could be worth mentioning that I have to log in to my website to edit any content/information. That's why I mentioned that I can log in and change from my local project, and then the changes appear on the website.

FOUND PROBLEM: I tried creating a user with a non-hashed password and deleted the .GetHashCode.ToString() from the AuthenticateLogin on the password. Then i re-published. It works. The problem is the hashing.

How can I solve this? I need hashed passwords in the db...


  • Do you store your content and the identity information on the same database or do you have 2 sperate connections? - Marco
  • Same database just (which kind of obvious) different tables. - thejokerish
  • Verify your database connection sting in your config. - Sudipta Kumar Maiti
  • Im not quite sure what you mean with "verify" but shouldn't it be correct since I get all the updates from the db to my site when I update locally? - thejokerish
  • @Jokerish As a better approach, use some standard hashing algorithm to hash and save passwords, so that you can get rid of such machine specific constraints. Also pick a strong hashing algorithm and check with your hosting provider if they support that hashing for hosting membership you own and go for implementation. - Siva Gopal

2 답변


2

How did you seed the username and password in your database? If the implementation of password.GetHashCode() is machine specific (i.e. relies on a machine specific salt) then this could be why it cannot match against any users. On the other hand if the users were created via the remote (hosted) environment, this should not be a problem.


  • I added my users with a method from within my local project. I used the method in my first page's controller, then i ran the project one time. After that, I removed the method so that this wouldn't happen every time you enter the page. But yeah, the users were created from within my own project - thejokerish
  • OK, so by the sounds of it, it isn't the salt that's the problem. What' the collation of your hosted database? Could it be case-sensitivity of the username? - CalC
  • Please check my latest edit in my first post mate, I found the problem. Just need to solve my next problem now... - thejokerish
  • OK, so what is your implementation of GetHashCode() - can you post it or is it just the standard framework implementation? - CalC
  • Well the first thing I would say is that for cryptographic hashes, you should use a class derived from the System.Security.Cryptography.HashAlgorithm or System.Security.Cryptography.KeyedHashAlgorithm class. With regard to your current problem you may also want to look at this post: stackoverflow.com/questions/8838053/…. - CalC

0

The problem was caused by my hashing. Apprenatly, two strings that looks exactly the same can produce different values when hashed, with standard framework implementation of .GetHashCode(), on different machines (even though the machines are using the same version of the framework).

For more information, click here!

I Solved my problem by using a customized Hashing-class.

Linked


Related

Latest