面对加密密码与登录的问题？

Question

当我使用加密密码功能登录时，登录无效，当我登录时没有加密密码功能，那么登录就可以了。

HomeController.cs

        public static string Encrypt(string clearText)
        {
            try
            {
                byte[] hashBytes = ComputeHash(clearText);
                byte[] saltBytes = GetRandomSalt();
                byte[] saltHash = ComputeHash(saltBytes.ToString());

                byte[] hashWithSaltBytes = new byte[hashBytes.Length + saltBytes.Length];
                for (int i = 0; i < hashBytes.Length; i++)
                    hashWithSaltBytes[i] = hashBytes[i];
                for (int i = 0; i < saltBytes.Length; i++)
                    hashWithSaltBytes[hashBytes.Length + i] = saltBytes[i];

                string hashValue = Convert.ToBase64String(hashWithSaltBytes);

                return hashValue;
            }
            catch (Exception)
            {

                throw;
            }
        }

        //random salt generation
        public static byte[] GetRandomSalt()
        {
            int minSaltSize = 16;
            int maxSaltSize = 32;

            Random random = new Random();
            int saltSize = random.Next(minSaltSize, maxSaltSize);
            byte[] saltBytes = new byte[saltSize];
            RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
            rng.GetNonZeroBytes(saltBytes);
            return saltBytes;
        }
        // hashing
        public static byte[] ComputeHash(string plainText)
        {
            byte[] plainTextBytes = Encoding.UTF8.GetBytes(plainText);
            HashAlgorithm hash = new SHA256Managed();
            return hash.ComputeHash(plainTextBytes);
        }

        public ActionResult create()
        {
            return View();
        }

        [HttpPost]
        public ActionResult create(student stud)
        {

            string pass = Encrypt(stud.password);
            stud.password = pass;        //here assigning a string pass to stud.pass

            var create = dbstud.students.Add(stud);
            dbstud.SaveChanges();
            return RedirectToAction("Login");

        }

        public ActionResult Login()
        {
            return View();
        }

        [HttpPost]
        public ActionResult Login(student stud)
        {
            var login = dbstud.students.Where(x => x.username == stud.username && x.password == stud.password).FirstOrDefault();

            if (login != null)
            {
                Session["username"] = login.username.ToString();
                Session["password"] = login.password.ToString();

                return RedirectToAction("Index");
            }

            return RedirectToAction("Login");
        }

Login.cshtml

@model DemoFFI.Models.student

@{
    ViewBag.Title = "Login";
}

<h2>Login</h2>

@using (Html.BeginForm())
{
    @Html.LabelFor(m => m.username)<br />
    @Html.TextBoxFor(m => m.username)<br />

    @Html.LabelFor(m => m.password)<br />
    @Html.TextBoxFor(m => m.password)<br />

    <input type="submit" />
}
@Html.ActionLink("Create a New Registration", "Create")

当我注释此代码时，登录功能可以正常工作，但密码不存储加密格式的

            string pass = Encrypt(stud.password);
            stud.password = pass;        //here assigning a string pass to stud.pass

当我取消注释此代码时，登录功能不起作用，而是密码存储加密格式

            string pass = Encrypt(stud.password);
            stud.password = pass;        //here assigning a string pass to stud.pass

我在登录功能中添加了这一行

if (login != null)
            {
                login.password = Encrypt(stud.password);

                Session["username"] = login.username.ToString();  //I add this line

Index.cshtml

@model DemoFFI.Models.student

<h2>Index</h2>

@if (Session["username"] != null)
{
    <text>Welcome <strong>@Session["username"].ToString()</strong></text>
}

<p>

    @Html.ActionLink("Logout", "Logout")

</p>
<table class="table">
    <tr>
        <td>
            @Html.DisplayFor(model => model.firstname)
        </td>
        <td>
            @Html.DisplayFor(model => model.lastname)
        </td>
        <td>
            @Html.DisplayFor(model => model.username)
        </td>
        <td>
            @Html.DisplayFor(model => model.password)
        </td>
        <td>
            @Html.DisplayFor(model => model.email)
        </td>
        <td>
            @Html.ActionLink("Edit", "Edit", new { id = Model.studid })
        </td>
    </tr>
</table>
@{ Html.RenderAction("BlogCreate", "Home"); }

这里给出一个错误：

<td>
            @Html.ActionLink("Edit", "Edit", new { id = Model.studid }) //**here give an eror object referance not set to an object**
</td>

如何解决这个问题？

Answer 1

您已将加密密码保存在DB中，在检查用户名和密码的WHERE条件下，密码未加密。在将密码传递到WHERE条件之前，需要对用户输入的密码进行加密。

在登录post操作中

string pass = Encrypt(stud.password);
var login = dbstud.students.Where(x => x.username == stud.username && x.password == pass ).FirstOrDefault();

Answer 2

您在登录操作中没有加密您的密码。如果将加密密码存储在数据库中，则还必须在登录操作中加密密码。否则，您将无法检索匹配的记录。