Dot net MVC secure Forms Authentication

Question

In my dot net MVC application, I have a Login page where user enters username and password. On clicking submit button the username and password are sent in plain text over the wire. Is there a simple way in which I can send encrypted username/passwords from the login form and decrypt then in the controller on server side. OR if there is any simpler way to prevent passwords being sent in plain text? Thanks.

Darin Dimitrov · Accepted Answer · 2012-10-08 09:24:36Z

2

Just use HTTPS, it's what it is designed for and it will ensure that the username and password won't be sent in clear text over an unencrypted channel.

Also in your web.config you could require SSL for the authentication cookie which will ensure that it will never be transmitted over a non-encrypted channel.

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="2880" requireSSL="true" />
</authentication>

answered Oct 8, 2012 at 9:24

Darin Dimitrov

1.0m276 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

sunny days Over a year ago

Hi, Thanks for the answer. I'm new to web technologies so Can you please guide me or provide a link on how to deploy my website so that it is SSL enabled. I'm using dot net mvc4 on IIS7. Thanks

Darin Dimitrov Over a year ago

You will need to install an SSL certificate on your web server. Configuring your web server is off-topic for StackOverflow. There are discussions about this on serverfault.com. Or just Google it. Here's the first hit I got: digicert.com/ssl-certificate-installation-microsoft-iis-7.htm

Collectives™ on Stack Overflow

Dot net MVC secure Forms Authentication

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related