What is the best practice for mvc2 confirm password field?

Question

I have asked a similar question recently but getting no answers i am taking a step back with a more broad approach.

I am looking to create a confirm password field using asp.net MVC2 that works on the client. All my other client validation is done with MicrosoftMvcValidation.js by just adding the Html.EnableClientValidation(); call.

Some of my considerations. Should the confirm password be part of the model object? Using that approach i have created server side validation by creating my own model binder.

Are there any projects out there that have done this?

Answer 1

I have an idea about password confirmation:

We sign up to hundreds of sites, and it amazing that almost all of them force us to confirm password. This doesn't make any sense. For sure you give users a way to reset their passwords, so what is the point of confirming it? If someone forgets it or had a typo in it (which is rare anyway), then (s)he just resets the password. Personally, I feel that password confirmation is a waste of time and resources and is not very user-friendly. (there is not any password confirmation in most of new site, like facebook, etc...)

Answer 2

The confirm password should definitely not be part of the model object. There is no need to store it. And I can't see why you need a custom model binder, either?

Just have two password fields. One will be the real password you store, the other will be a dummy field that is just used for confirmation. You then just check in your controller (or wherever) that the two passwords match. It's not something that needs to be complex.