Authenticate the Valid User Via User id and MD5 Hashed Password

Note. The "hex_md5" function exists in the "md5.js" file and here the conversion of the password into a hash has been done 2 times. First for converting the plain text to a hash then the hashed text to a hash with salt, just for safety purposes. If I do the single hash and match it on the server side then any hacker can get the hash password and easily enter it into the system.

Step 5. Add the code on the page load for creating the salt and send it the JavaScript function via attribute add of the save button and on the button click event to save the data.

1. Create a method that will get the size of the salt and return a salt after generation via the random number generator cryptography technique.

   private string CreateSalt(int size)
   {
       RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
       byte[] buff = new byte[size];
       rng.GetBytes(buff);
       return Convert.ToBase64String(buff);
   }
   

2. Get the value in the salt variable and add the JavaScript function with the salt parameter via the attribute add of the save button.

   protected void Page_Load(object sender, EventArgs e)
   {
       if (!IsPostBack)
       {
           //get the 5 digit salt
           string salt = CreateSalt(5);
   
           //Save the salt in session variable
           Session["salt"] = salt.ToString();
   
           //Add the JS function call to button with a parameter
           btn_login.Attributes.Add("onclick", "return HashPwdwithSalt('" + salt.ToString() + "');");
       }
   }
   

3. Get the hash password from the database, if the user id is valid. Then hash it again with an already generated salt and match it with the filled-in password by the user to check the authenticity of the user on the login button click event.

   protected void btn_login_Click(object sender, EventArgs e)
   {
       if (txtUserID.Text != "" && txtpwd.Text != "")
       {
           //Get the password from the database
           using (SqlConnection connection = new SqlConnection())
           {
               connection.ConnectionString = ConfigurationManager.ConnectionStrings["constr"].ToString();
               connection.Open();
               SqlCommand cmd = new SqlCommand();
               cmd.Connection = connection;
               string commandText = "Select pwd from LoginTable where UserID='" + txtUserID.Text + "'";
               cmd.CommandText = commandText;
               cmd.CommandType = CommandType.Text;
               object pwd = cmd.ExecuteScalar();
               cmd.Dispose();
               connection.Close();
   
               // create the hash of the correct password with salt
               string hashed_pwd = FormsAuthentication.HashPasswordForStoringInConfigFile(pwd.ToString().ToLower() + Session["salt"].ToString(), "md5");
   
               // match the both passwords
               if (hashed_pwd.ToLower().Equals(txtpwd.Text))
               {
                   Response.Write("Valid User");// redirect to Home page
               }
               else
               {
                   Response.Write("Invalid User");
                   return;
               }
           }
       }
   }
   

At Run Time

After running the page, check both of the conditions for authenticity for correct and incorrect passwords.

For Valid User

type the valid user ID and password.

Note. Here the valid User ID is "Admin" and the password is "abcd1234".

Result

Then the output will be a valid user.

For Invalid User

If I fill in the wrong password then it will give a different output.

Here I have provided "123" as the password.

Result

Then the output will be "Invalid user".