How to properly implement "Confirm Password" in ASP.NET MVC 3?

Question

There's already an answered question about the same subject but as it's from '09 I consider it outdated.

I'm seeing a lot of options on the Web, most of them using the CompareAttribute in the model like this one

The problem is that definitely ConfirmPassword shound't be in the model as it shouldn't be persisted.

As the whole unobstrusive client validation from MVC 3 rely on the model and I don't feel like putting a ConfirmPassword property on my model, what should I do?

Should I inject a custom client validation function? If so.. How?

Not all the types (or type members) that are in Model must be persisted. What about your server validation? — oleksii
– oleksii, Commented Jul 23, 2011 at 16:48
Not only ConfirmPassword, but also Password should not be persisted. Darin Dimitrov's solution with a ViewModel is correct except for the note about AutoMapper. You should always salt and secure hash password prior to persisting it. — Juraj Suchár
– Juraj Suchár, Commented Aug 15, 2012 at 9:58
Darin never indicated that he would persist the plaintext password, he just said that he would map the viewmodel to a domain model, and pass that to a repository. I would argue that the details of hashing a password more correctly belongs with the persistence code than in the presentation code (Why should my MVC controllers have to know the details of a secure hash?). — David Hay
– David Hay, Commented Feb 20, 2014 at 18:46

Shaiju T · Accepted Answer · 2016-02-13 15:56:38Z

99

As the whole unobstrusive client validation from MVC 3 rely on the model and I don't feel like putting a ConfirmPassword property on my model, what should I do?

A completely agree with you. That's why you should use view models. Then on your view model (a class specifically designed for the requirements of the given view) you could use the [Compare] attribute:

public class RegisterViewModel
{
    [Required]
    public string Username { get; set; }

    [Required]
    public string Password { get; set; }

    [Compare("Password", ErrorMessage = "Confirm password doesn't match, Type again !")]
    public string ConfirmPassword { get; set; }
}

and then have your controller action take this view model

[HttpPost]
public ActionResult Register(RegisterViewModel model)
{
    if (!ModelState.IsValid)
    {
        return View(model);
    }

    // TODO: Map the view model to a domain model and pass to a repository
    // Personally I use and like AutoMapper very much (http://automapper.codeplex.com)

    return RedirectToAction("Success");
}

edited Feb 13, 2016 at 15:56

Shaiju T

6,65324 gold badges112 silver badges201 bronze badges

answered Jul 23, 2011 at 19:18

Darin Dimitrov

1.0m277 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

jocull Over a year ago

I don't have a Compare attribute available... what am I missing?

Darin Dimitrov Over a year ago

@jocull, erm, ASP.NET MVC 3? If you are using an older version you won't have this attribute.

jocull Over a year ago

It's definitely MVC 3... am I missing an included assembly?

Darin Dimitrov Over a year ago

@jocull, read the documentation. Assembly: System.Web.Mvc.dll. Namespace: System.Web.Mvc.

Mariusz Jamro Over a year ago

In newer C# its better use [Compare(nameof(Password), ...] instead of hardcoding Password property name.

|

Henk Holterman · Accepted Answer · 2011-07-23 17:01:39Z

3

Take a look at the default VS2010 template for a MVC3 app.

It contains a RegisterModel (a 'ViewModel') that contains the Password and ConfirmPassword properties. The validation is set on the ConfirmPassword.

So the answer is that the Models in MVC don't have to be (usually aren't) the same as your business Models.

answered Jul 23, 2011 at 17:01

Henk Holterman

276k33 gold badges353 silver badges540 bronze badges

Collectives™ on Stack Overflow

How to properly implement "Confirm Password" in ASP.NET MVC 3?

2 Answers 2

7 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related