Thread: Password Encryption

I have referenced the ASPDNSFEncrypt.dll, and am able to call its methods. I want to verify that the password entered in on my Login page is correct. I don't know if this is the preferred method, but I accessed the Customer table by email address and obtained the SaltKey. Then I encrypted the typed in password, with the SaltKey, and used it to verify the password in the Customer table. If there is a more direct method, please let me know.

What exactly are you trying to do? Are you trying to insert encrypted passwords directly into the customer table? Are you importing customers with plain text passwords and then trying to encrypt them?

If you are looking to have your own application authenticate against the ASPDNSF database, instead of referencing the ASPDNSFEncrypt.dll, couldn't you instead reference the AspDotNetStorefrontCore.dll (after 8.0.1.1, AspDotNetStorefrontCommon.dll before that) and then follow the logic used on the sign in page (assuming of course that you've got access to the proper connection string)?

Something like:

C#/VB.NET Code:

bool LoginOk;
c = new Customer(EmailAddress, true);
if (c.IsRegistered)
{
    // Check the password
    LoginOk = c.CheckLogin(PassworField);

    if (LoginOk)
    {
        // See if they are unlocked, active and if true, do what you want with this information
    }
    else
    {
        // Your code to handle failed logins
    }
}
else
{
    // Customer doesn't have a login in the store
} 


Would that work for you?

Hi, I think we have the same problem. I am developing a windows application that connects to our storefront's database. How could I access the unencrypted password value and compare it with the value of my password.Text value?

Originally Posted by witchikikoy

Hi, I think we have the same problem. I am developing a windows application that connects to our storefront's database. How could I access the unencrypted password value and compare it with the value of my password.Text value?

I don't believe you would want to get the password in clear text and compare it to the password you are passing it. I believe the better option would be to encrypt your password and compare it to the encrypted password in the db.