WebMatrix WebSecurity PasswordSalt

Question

I am using WebMatrix and have built a website based on the \"StarterSite\". In this starter site you get a nice basic layout - including registration, login, forgot password

Answer 1

As of the RTM release of WebMatrix/ASP.NET Web Pages, the salt feature/column is unused.

If you open up the Web Pages source, you'll see the db classes littered with references like

INSERT INTO [" + MembershipTableName + "] (UserId, [Password], PasswordSalt

...

VALUES (uid, hashedPassword,String.Empty /* salt column is unused */

shortened for emphasis

There are definately ways to override and implement this behavior, first being:

• override System.WebData.SimpleMembershipProvider.CreateAccount()

or

• extend with System.WebData.SimpleMembershipProvider.CreateAccountWithPasswordSalt()

not going to go into detail there though unless you request, as your usage of WebMatrix and a template suggests you probably don't wanna mess with rewriting a ton of your own C#/ASP code for this project.