C# web service password in the request to be encrypted

Question

I am working on the web service. A user is going to be able to create a user account using a form on different asp.net project. So when the user enters the password information I need to store that encrpted in a database. But now when the user sends the user credentials through for a web services then I need to the user to send that password encrpted for security purposes.

Now how can we both have the same ecrption procedure so that I will be able to validate the request.

Answer 1

What you want is to use HTTPS connection to transfer the password from the user to the server safely. Here is the explanation on how to set up the development environment with IIS for HTTPS - scottgu link .

HTTPS protocol will handle the encryption and decryption and you just deal with the plain-text password on the server-side.

After that, on the server side, you compute the hash of the password and compare it to the hash stored in the database. Standard ASP.NET SQL membership provider can be used for this.

There is a good explanation from Jeff Atwood on the problems behind storing and hashing passwords - coding horror link .

Answer 2

You can encrypt the info you need using System.Security.Cryptography;

have a look at the below:

http://jakkaj.wordpress.com/2007/10/27/encrypting-and-securing-web-service-traffic-without-ssl/

Bear in mind that anything you do to provide "encryption" that isn't using SSL/TLS is likely to be vulnerable

Answer 3

If the user's browser in any way knows how to encrypt your password then you kind of lose the point and a smart hacker could extract that encryption.

Using SSL to pass information directly to your application is essentially doing what you're asking and is the accepted secure way to receive the password. You will just have to check against your encrypted version in the database.

Your app receives the password raw (browser and server have taken care of encrypt/decrypt), then your app encrypts it and looks in the database for a match.

The other way this is done with web services is using a single login step that returns an expiring token which is used for further communication. OAuth is the most popular so do some googling on that.