使用ASP.NET身份个人帐户的MVC-如何添加安全性问题？

Question

Here is my Scenario:

I need to capture at least 3 security questions & Answers as a part of user registration for an Website (Built in MVC 5 using Individual User Accounts as means of Authentication). Which I can do by extending ApplicationUser object.

So far so good.

I would like to ask these questions in the password recovery process.

I didn't find any support for security questions in ASP.NET Identity framework.

My Question:

Do I need to implement security questions out side of built in UserStore library or is there existing support similar to Secret questions in ASP.NET Membership functionality in .NET 2.0?

Note: Let me know if you need more information.

Answer 1

To do this in ASP.Net Identity, you treat the answers as custom passwords.

Use userManager.PasswordHasher.HashPassword(Answer1); to generate a hash for each answer to store in custom class properties/fields in the database. (Where userManager is the instance of the Identity UserManager)

On recovery, use

var verification = userManager.PasswordHasher.VerifyHashedPassword(dbHash, Answer1);

to verify the challenge.

You can then check if verification.Success is true for each answer.

ref: MSDN